PracticeVideosBlogFlashcardsEspañol
All Practice Exams

Free Practice Questions for CHPC

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
210+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More CCB Healthcare Compliance Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

CHC Certified in Healthcare Compliance

Practice QuestionsStudy GuideCheat SheetFlashcards1 video1 blog

CHRC Certified in Healthcare Research Compliance

Practice Questions

More From This Family

Videos and articles for deeper review.

VideoCHPC Exam Guide 2026: Current Format, Eligibility, Blueprint, and Free PracticeThis examVideoCHC Exam Guide 2026: Healthcare Compliance Prep That Focuses on the 7 DomainsArticleCHPC Exam Guide 2026: Current Format, Eligibility, Blueprint, and Free Practice16 min readArticleCHC Exam Guide 2026: Healthcare Compliance Prep That Focuses on the 7 Domains16 min read
Exam Review

Key Facts: CHPC Exam

120

Exam Questions (100 scored)

CCB/HCCA

2 hours

Exam Time Limit

CCB/HCCA

$350-$450

Exam Fee

CCB 2026 fee schedule

7 domains

Content Areas

CHPC Candidate Handbook (April 2025)

2 years

Certification Validity

CCB renewal policy

40 CEUs

Renewal Requirement

CCB (20 must be live)

The CHPC exam has 120 multiple-choice questions (100 scored) with a 2-hour time limit. The exam fee is $350 for HCCA members and $450 for non-members. Candidates need 1 year of compliance experience and 20 CCB CEUs. The exam covers 7 domains: privacy standards and policies, program oversight, vendor screening, training and education, monitoring and auditing, discipline, and investigations. Certification is valid for 2 years with 40 CEU renewal requirement.

Sample CHPC Practice Questions

Try these sample questions to review concepts for the CHPC exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 210+ question experience with AI tutoring.

1Under the HIPAA Privacy Rule, which of the following is considered protected health information (PHI)?
A.De-identified health data that cannot be linked to an individual
B.A patient's name with their diagnosis in a medical record
C.Aggregate statistical data about hospital admissions
D.Employment records held by a covered entity as an employer
Explanation: PHI is individually identifiable health information held or transmitted by a covered entity or its business associate. A patient's name combined with a diagnosis in a medical record meets this definition. De-identified data, aggregate statistics, and employment records held by a covered entity in its capacity as employer are excluded from the definition of PHI under HIPAA.
2Which of the following is NOT one of the 18 HIPAA identifiers that must be removed to de-identify health information under the Safe Harbor method?
A.Patient's name
B.Dates related to an individual, except year over age 89
C.Blood type
D.Social Security number
Explanation: The HIPAA Safe Harbor method requires removal of 18 specific identifiers to de-identify health information. Blood type is not one of the 18 identifiers. The 18 identifiers include names, geographic data, dates, phone numbers, fax numbers, email addresses, SSN, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photos, and any other unique identifying number.
3A hospital privacy officer discovers that a nurse accessed the medical records of a celebrity patient without a treatment, payment, or operations reason. What type of violation does this represent?
A.An incidental disclosure permitted under the Privacy Rule
B.A permitted use for healthcare operations review
C.An unauthorized access, or snooping, violation
D.A routine quality assurance record review
Explanation: Accessing patient records without a legitimate treatment, payment, or healthcare operations purpose constitutes unauthorized access, commonly called 'snooping.' This is a HIPAA violation regardless of whether the information is further disclosed. Healthcare organizations must implement access controls, audit trails, and sanctions for unauthorized access. Celebrity and VIP records are frequently targeted and require additional safeguards and monitoring.
4Under HIPAA, a patient has the right to request an accounting of disclosures of their PHI. Which of the following disclosures must be included in the accounting?
A.Disclosures for treatment purposes to another provider
B.Disclosures made to the individual who is the subject
C.Disclosures to a state public health authority
D.Disclosures made under a valid patient authorization form
Explanation: Disclosures to public health authorities for disease reporting must be included in the accounting of disclosures. HIPAA exempts several types of disclosures from the accounting requirement, including disclosures for treatment, payment, and healthcare operations; disclosures made to the individual; disclosures pursuant to an authorization; disclosures for national security purposes; and disclosures to correctional institutions. The accounting must cover the 6 years prior to the request.
5What is the primary purpose of a Notice of Privacy Practices (NPP) under HIPAA?
A.To obtain patient consent before any medical procedure is performed
B.To describe permitted uses, disclosures, and individual rights
C.To serve as the entity's business associate agreement
D.To log every prior disclosure of a patient's information
Explanation: The Notice of Privacy Practices (NPP) is required by the HIPAA Privacy Rule to inform individuals about how a covered entity may use and disclose their PHI, the individual's rights regarding their information, and the covered entity's legal duties with respect to PHI. The NPP must be provided at the first service delivery and made available upon request. It is not a consent form, BAA, or disclosure log.
6Which federal law strengthened HIPAA enforcement and extended privacy requirements to business associates?
A.The Affordable Care Act (ACA)
B.The HITECH Act (part of ARRA 2009)
C.The Genetic Information Nondiscrimination Act (GINA)
D.The Family Educational Rights and Privacy Act (FERPA)
Explanation: The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, significantly strengthened HIPAA enforcement by increasing penalties, requiring breach notification, extending certain HIPAA requirements directly to business associates, and mandating periodic audits. HITECH also established the meaningful use program for electronic health records.
7A covered entity receives a valid subpoena for patient records that is not accompanied by a court order. Under HIPAA, what must the covered entity verify before disclosing the records?
A.That the requesting attorney is licensed in the state where the court sits
B.That the patient was notified or a qualified protective order exists
C.That the records requested are less than five years old
D.That the subpoena was issued by a federal rather than state court
Explanation: When a covered entity receives a subpoena without a court order, HIPAA requires verification that the individual whose records are sought has been given notice and an opportunity to object, or that a qualified protective order has been obtained. This protects patient privacy rights while permitting legitimate legal processes. A court order itself would be sufficient authorization, but a subpoena alone requires these additional safeguards.
8The minimum necessary standard under HIPAA requires covered entities to:
A.Disclose all available patient information for any legitimate request
B.Limit uses, disclosures, and requests to the minimum needed
C.Provide the complete medical record only to treating physicians
D.Restrict all disclosures of PHI to law enforcement agencies
Explanation: The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI uses, disclosures, and requests to the minimum necessary to accomplish the intended purpose. This applies to most uses and disclosures but does not apply to disclosures for treatment, disclosures to the individual, disclosures pursuant to an authorization, disclosures required by law, or disclosures to HHS for enforcement purposes.
9Which of the following situations requires a written patient authorization under HIPAA before PHI can be disclosed?
A.Disclosing PHI to another provider for treatment purposes
B.Reporting suspected child abuse to a state protective agency
C.Using PHI in marketing communications to the patient
D.Disclosing PHI to a health plan for payment purposes
Explanation: HIPAA requires a valid written authorization before using or disclosing PHI for marketing purposes. Marketing is defined as a communication about a product or service that encourages the recipient to purchase or use it. Exceptions exist for face-to-face communications and promotional gifts of nominal value. Disclosures for treatment, payment, and required reporting (such as child abuse) do not require authorization.
10A privacy officer is developing a new organizational privacy program. Which element should be established FIRST?
A.A graduated sanctions policy covering privacy violations
B.A risk assessment identifying privacy vulnerabilities
C.A marketing plan for the privacy training materials
D.A monthly employee newsletter on privacy awareness
Explanation: A comprehensive risk assessment should be the first step in developing a privacy program because it identifies the organization's privacy vulnerabilities, regulatory obligations, and areas of highest risk. The results of the risk assessment then inform the development of policies, procedures, training programs, and monitoring activities. Without understanding the organization's specific risks, other program elements cannot be effectively designed or prioritized.

About the CHPC Exam

The CHPC exam validates expertise in healthcare privacy compliance, including HIPAA Privacy Rule, HITECH Act, state privacy laws, patient rights, breach notification, and privacy program management. Administered by the Compliance Certification Board through HCCA, it is the leading credential for healthcare privacy officers and compliance professionals responsible for protecting patient information and managing organizational privacy programs.

Exam sponsor: Compliance Certification Board (CCB) / Health Care Compliance Association (HCCA). The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

120 multiple-choice questions (100 scored, 20 pretest)

Time Limit

2 hours

Passing Score

Raw score of 100 scored items; Angoff-set minimum, not published

Exam / Certification Fees

$350 (member) / $450 (non-member)

Exam sponsor website

Reported exam pass rate: Not published by CCB. CCB uses the Angoff method to set the passing point and does not publish a universal raw passing percentage or official first-time pass rate Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

13%

Privacy Standards, Policies, and Procedures

Organizational privacy program components, policy development and review, governance, HIPAA/HITECH/FERPA/GINA regulatory requirements, record retention, and stakeholder notices.

25%

Privacy Compliance Program Oversight

Risk assessments, annual work plans, privacy officer roles, governance reporting, regulatory interpretation, program evaluation, and contract privacy elements.

7%

Screening/Evaluation of Employees, Physicians, Vendors and Other Agents

Privacy obligations in job descriptions, background checks, exit interviews, business associate agreements, due diligence on vendors, and data use agreements.

12%

Communication, Education and Training on Privacy Issues

Role-based training programs, privacy education for employees and physicians, regulatory dissemination, organizational privacy culture, and continuing education.

16%

Privacy Monitoring, Auditing, and Internal Reporting Systems

Risk assessments, audit plans, compliance monitoring, hotline and reporting systems, anonymity protections, trend analysis, and external audit responses.

10%

Discipline for Non-Compliance

Disciplinary policies for privacy violations, corrective action coordination, proportionate sanctions, consistency monitoring, and documentation requirements.

17%

Investigations and Remedial Measures

Privacy investigations, breach response coordination, disclosure notifications, corrective action plans, regulatory agency interactions, and harm mitigation.

Preparing for the CHPC Exam

What You Need to Know

  • Passing score: Raw score of 100 scored items; Angoff-set minimum, not published
  • Assessment: 120 multiple-choice questions (100 scored, 20 pretest)
  • Time limit: 2 hours
  • Exam / certification fees: $350 (member) / $450 (non-member) Official sources

Using Our Practice Resources

  • Work through all 210 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

CHPC: Suggested Study Strategy

1Master the HIPAA Privacy Rule fundamentals — permitted uses and disclosures, minimum necessary standard, and the distinction between consent and authorization
2Know all patient rights under HIPAA: access, amendment, accounting of disclosures, restriction requests, confidential communications, and the right to file complaints
3Study the 7 elements of an effective compliance program as outlined by the OIG and understand how each applies to a privacy compliance program
4Understand business associate agreement requirements, vendor due diligence, and when BAAs are required versus data use agreements
5Focus heavily on breach notification: the 4-factor risk assessment, notification timelines (60 days for individuals, annual for HHS), and state law variations

Frequently Asked Questions

What is the CHPC certification?

The CHPC (Certified in Healthcare Privacy Compliance) is a professional credential offered by the Compliance Certification Board (CCB) through the Health Care Compliance Association (HCCA). It validates expertise in healthcare privacy compliance, including HIPAA Privacy Rule, HITECH Act, state privacy laws, patient rights, breach notification, and privacy program management. It is the leading certification for healthcare privacy officers and compliance professionals.

How many questions are on the CHPC exam?

The CHPC exam consists of 120 multiple-choice questions, but only 100 are scored. The remaining 20 are unscored pretest questions used for exam development. You have 2 hours to complete all 120 questions. The pretest questions are randomly distributed throughout the exam and cannot be distinguished from scored questions, so you should answer every question carefully.

What are the eligibility requirements for CHPC certification?

To qualify for the CHPC exam, you must have at least 1 year of full-time compliance experience (or 1,500 hours of direct compliance duties within 2 years before your application). Your job duties must relate to the CHPC Detailed Content Outline. You must also earn and submit 20 CCB-approved Continuing Education Units (CEUs) within 12 months of your anticipated exam date.

How much does the CHPC exam cost?

The CHPC exam application fee is $350 for HCCA/SCCE members and $450 for non-members. If you need to retake the exam, there is a $75 non-refundable re-exam application fee. If you fail two attempts within 180 days, you must wait 180 days before reapplying. A $75 rescheduling fee may also apply if you need to change your exam date.

How do I maintain my CHPC certification?

CHPC certification is valid for 2 years. To renew, you must earn 40 CCB Continuing Education Units (CEUs) during your certification period, with at least 20 coming from live training events. The renewal fee is $145 for HCCA/SCCE members and $265 for non-members. If you need additional time, monthly renewal extensions are available for $50 per month, up to a two-month maximum.