Free CHPC Exam Flashcards

Individually identifiable health information that a covered entity or business associate creates, receives, maintains, or transmits, in any form or medium. Four exclusions: FERPA education records, the student treatment records FERPA describes, employment records the entity holds as an employer, and information about a person dead for more than 50 years. The exclusions decide whether a privacy policy applies at all.

Safe Harbor removes 18 listed identifiers and requires no actual knowledge that the remaining data could identify someone. Expert Determination has a person with appropriate statistical and scientific expertise document that the re-identification risk is very small. Data that meets either standard is no longer PHI and leaves the Privacy Rule.

A limited data set removes 16 direct identifiers but may keep dates, and town or city, state, and ZIP. It is still PHI. It may be used only for research, public health, or health care operations, and only under a data use agreement with the recipient.

Disclosures to, or requests by, a provider for treatment; uses or disclosures to the individual; anything done under a valid authorization; disclosures to HHS for enforcement; uses or disclosures required by law; and uses or disclosures required to comply with the HIPAA rules. Everywhere else you must limit PHI to what the purpose actually needs.

A covered entity may use and disclose PHI for its own TPO without an authorization. This is the default lane for most clinical and billing work, which is why staff who route a request into TPO by habit are the ones who cause impermissible disclosures.

Psychotherapy notes (narrow exceptions, such as use by the originator for treatment), marketing, and any sale of PHI. Marketing needs an authorization even when nobody pays for it; the only carve-outs are face-to-face communications and promotional gifts of nominal value. If a third party pays for the marketing, or a sale brings remuneration, the authorization must say so.

A covered entity must act on an access request within 30 days. It may take one 30-day extension, and only one, if it gives the individual a written reason and a completion date. Right-of-access failures are among the most frequently penalized HIPAA violations.

Individuals may request an accounting of disclosures made in the six years before the request. TPO disclosures, disclosures to the individual, disclosures under an authorization, incidental disclosures, and limited data set disclosures are all excluded, which is why the list is shorter than patients expect.

A covered entity may normally decline a requested restriction. It must agree when the individual (or someone other than the plan) pays for an item or service in full out of pocket and asks that it not be disclosed to a health plan for payment or health care operations, unless the disclosure is required by law.

The Privacy Rule requires a designated privacy official responsible for policies and procedures, plus a contact person to receive complaints. The Security Rule separately requires a named security official for ePHI. All designations must be documented; one person may hold more than one role.

Written policies and standards of conduct; a designated compliance officer and committee; effective training and education; effective lines of communication; internal monitoring and auditing; well-publicized disciplinary guidelines; and prompt response with corrective action. A privacy program is expected to show all seven.

Covered entities and business associates must conduct an accurate and thorough assessment of risks and vulnerabilities to ePHI, then implement risk management to reduce them. A vendor checklist or a policy gap review is not a risk analysis, and OCR treats the substitution as a finding.

It converts risk-assessment output into scoped, owned, and dated actions for the year, and it drives the audit and monitoring plan. Without it the program reacts to incidents; with it the privacy officer can show the board why specific risks were worked and others deferred.

The board is accountable for oversight, so it needs regular, structured reporting: risk areas, audit results, incident and breach volume, sanction trends, and open corrective actions. Governance guidance from OIG expects boards to ask for metrics, not accept assurance.

A contrary state law is preempted unless it is more stringent for privacy, provides for public health reporting or health plan audits, or the Secretary has determined it is needed for fraud and abuse control, insurance regulation, cost or delivery reporting, or controlled substances. Multi-state programs must map law by state.

Substance use disorder records rules now align with HIPAA in key ways: one written consent can cover all future treatment, payment, and operations disclosures, HIPAA breach notification applies, and HHS enforces through OCR with HIPAA-style civil and criminal penalties. Part 2 still bars use of the records in proceedings against the patient without consent or a court order.

Four culpability tiers, per violation: did not know, $145 to $73,011; reasonable cause, $1,461 to $73,011; willful neglect corrected within 30 days, $14,602 to $73,011; willful neglect not corrected, $73,011 to $2,190,294. The calendar-year cap for one provision is $2,190,294, and OCR's 2019 enforcement discretion applies lower annual caps to the first three tiers.

A business associate is a person or entity that creates, receives, maintains, or transmits PHI to perform a function or service for a covered entity. Workforce members are not business associates, and a mere conduit that only transports data without accessing it is generally not one either.

A business associate must execute its own agreement with any subcontractor that handles PHI, and the obligation flows down the whole chain. Since HITECH, business associates are directly liable to OCR, so a covered entity's contract does not absorb the vendor's exposure.

Use a business associate agreement when a vendor performs a service on your behalf using PHI. Use a data use agreement when you release a limited data set for research, public health, or health care operations. Signing the wrong instrument is a common vendor-file audit finding.

Write privacy duties into job descriptions and evaluations, run background checks as applicable law requires, and apply termination procedures that cut system access when the relationship ends. Exit interviews are the last chance to document that confidentiality duties survive employment.

Train every workforce member on the policies and procedures relevant to their function: existing staff by the compliance date, new members within a reasonable time after joining, and affected staff again within a reasonable time after a material policy change. Document each round.

The Security Rule requires a security awareness and training program for the entire workforce, including management. Its implementation specifications (security reminders, malicious software protection, log-in monitoring, password management) are addressable under the current rule, so a documented alternative may substitute. The January 2025 proposed Security Rule would make them required but has not been finalized.

General privacy training gives everyone the baseline. Risk-specific training targets the group and behavior your risk assessment or audit flagged, such as a unit with repeat access violations. Repeating the general module after an incident is the classic ineffective corrective action.

HIPAA documentation, including training records, must be retained for six years from creation or from the date it was last in effect, whichever is later. In an OCR review, training that cannot be evidenced by roster, date, and content did not happen.

The April 2024 rule barred using PHI to investigate lawful reproductive care and required attestations for certain requests. On June 18, 2025, a federal court in Purl v. HHS vacated most of it nationwide. Within the Notice of Privacy Practices changes, only 45 CFR 164.520(b)(1)(ii)(F), (G) and (H) were vacated; the remaining NPP modifications, including the 42 CFR Part 2 notice updates, still took effect February 16, 2026. Training, forms, and notices that still cite the attestation are outdated; state reproductive-privacy laws still apply.

A provider with a direct treatment relationship must give the notice no later than the first service delivery, and must make a good-faith effort to obtain written acknowledgment. If acknowledgment is not obtained, document the effort and the reason. In an emergency, provide the notice as soon as practicable.

Workforce means employees, volunteers, trainees, and anyone else whose conduct is under the direct control of the entity, paid or not. Credentialed physicians, students, volunteers, and board members routinely fall outside payroll-driven training rosters and become the coverage gap.

A program that only punishes errors gets silence. Publicized guidance channels, a named person to call, and visible non-retaliation turn ambiguous requests into consultations. Volume of privacy questions is a leading indicator of culture; a drop to zero is a warning, not a win.

CHPC certification lasts two years and renews on 40 CCB continuing education units earned in that period, at least 20 from live training. Initial-eligibility CEUs cannot be reused for renewal, so the clock restarts the day you pass.

Monitoring is continuous and owned by the operating unit. Auditing is periodic, formal, and conducted independently of the area under review. The content outline expects investigations to be run independently of the operational unit, so the unit cannot audit or investigate itself.

The Security Rule requires regular review of audit logs, access reports, and security incident tracking reports. Audit controls elsewhere in the rule require the recording mechanism; this specification requires that someone actually reads the output. Collecting logs nobody reviews satisfies neither.

Build flags for same-surname matches, VIP and high-profile patients, employees appearing as patients, co-worker and family lookups, and access outside a user's assigned unit. Workforce snooping is rarely self-reported, so detection depends on proactive log review rather than complaints.

Start from the risk assessment, then fix scope, population, sample size, and pass criteria before testing begins. Setting criteria after seeing results makes the finding indefensible and makes trending across years impossible.

A hotline, open-door route, drop box, or web form only works if employees, physicians, vendors, and other agents all know it exists and how to reach it. The outline treats publicizing the mechanism as a separate obligation from operating it.

Anonymity means the reporter's identity is never captured. Confidentiality means the identity is known but protected within legal and practical limits, which a subpoena or a small fact pattern can defeat. Promise only what the process can actually deliver.

A covered entity may not intimidate, threaten, coerce, discriminate against, or otherwise retaliate against anyone for exercising a HIPAA right, filing a complaint, or taking part in an investigation. The rule bans the conduct; the CHPC outline separately expects the privacy officer to ensure a written non-retaliation policy exists and is publicized.

A workforce member or business associate who believes in good faith that the entity is acting unlawfully or endangering patients may disclose PHI to a health oversight agency, public health authority, accreditation body, or their own attorney. The entity has not violated the Privacy Rule when they do.

A complaint must be filed with the Secretary within 180 days of when the complainant knew or should have known of the act, unless the deadline is waived for good cause. When a patient threatens to report you, that window is the reason to preserve records immediately.

The Privacy Rule requires appropriate sanctions against workforce members who violate privacy policies, and the Security Rule requires the same for security policies. Both require documenting the sanctions actually applied, so an unwritten disciplinary practice fails on the documentation prong.

Match the response to conduct and intent: an inadvertent look at the wrong chart, deliberate snooping out of curiosity, and selling PHI are three different offenses. A single automatic-termination rule for every violation suppresses self-reporting and starves the program of incidents.

The same conduct by a physician, an executive, and a nurse must draw comparable discipline. Monitor sanction data by role, unit, and violation type. Inconsistent enforcement is what OCR, an accreditor, and opposing counsel look for first.

The sanction standard does not reach a workforce member acting under the whistleblower or crime-victim provisions (disclosing in good faith to an oversight agency, accreditor, attorney, or law enforcement), or one who files a complaint, testifies, or opposes an unlawful practice in good faith. Disciplining any of them converts a defensible incident into a retaliation violation.

Breach notification is triggered only by unsecured PHI. PHI encrypted or destroyed per the HHS guidance is not unsecured, so a lost encrypted laptop needs no notification unless the decryption key was also exposed. This makes device and media encryption the highest-leverage single breach control.

Any impermissible use or disclosure of unsecured PHI is presumed to be a breach unless the entity demonstrates a low probability that the PHI was compromised. The covered entity or business associate bears the burden of proof, so the risk assessment must be written down and kept.

1) Nature and extent of the PHI, including the types of identifiers and the likelihood of re-identification. 2) Who used it or received it. 3) Whether the PHI was actually acquired or viewed. 4) The extent to which the risk has been mitigated. All four, at minimum, must be assessed.

Good-faith unintentional access by a workforce member acting within scope; inadvertent disclosure between two people authorized at the same entity or organized health care arrangement; and a good-faith belief the unauthorized recipient could not retain the information. The first two also require no further impermissible use.

Individual notice without unreasonable delay and no later than 60 days after discovery. Media notice on the same clock when more than 500 residents of one state or jurisdiction are affected. HHS notice within 60 days for 500 or more; smaller breaches are logged and filed within 60 days after the calendar year ends.

The business associate must notify the covered entity without unreasonable delay and no later than 60 days from discovery, with the affected individuals identified where possible. The covered entity remains responsible for individual notice but may delegate the task by contract.

A covered entity must mitigate, to the extent practicable, any known harmful effect of an improper use or disclosure. A corrective action plan then addresses the root cause rather than the single incident, with owners, dates, and effectiveness testing. OCR resolution agreements pair a payment with a monitored plan.