This guide organizes sixty teaching concepts into ten sequenced groups, moving from regulatory foundations through privacy operations, safeguards, and incident response. Each concept pairs a rule with a worked decision and a common error, so you practice choosing rather than memorizing. Read groups in order the first time, then use individual concepts as targeted review. Verify current requirements against official AHIMA materials and the underlying regulations before acting, since this guide teaches distinctions, not every detail of the rules.
Regulatory Landscape and Officer Responsibilities
1. Privacy Officer Versus Security Officer Duties
CHPS holders design, implement, and administer privacy and security programs. The practical split: privacy officers govern uses, disclosures, and patient rights; security officers govern safeguards protecting electronic systems and facilities. Route a question by its subject—information handling rules go to privacy, protection mechanisms go to security.
Example: A clinician asks who may view a restricted record set. Route it to the privacy officer because it concerns permitted uses, not system configuration.
Mistake to avoid: Sending disclosure-policy questions to the security officer because both titles sound interchangeable.
Reference: Certified in Healthcare Privacy and Security (CHPS); AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
2. Covered Entity Status Through Standard Transactions
A provider becomes a covered entity by transmitting health information electronically in connection with standard HIPAA transactions such as claims, eligibility inquiries, or referral authorization requests. General email use alone does not trigger coverage; the transmission must connect to a standard transaction, whether sent directly or through a billing service.
Example: A therapy practice emails appointment reminders but bills only on paper. It is not covered, because no electronic transmission connects to a standard transaction.
Mistake to avoid: Assuming any email or fax use automatically makes a small provider a covered entity.
Reference: HHS Summary of the HIPAA Privacy Rule
3. Health Plan Coverage and Its Exceptions
Health plans include medical, dental, vision, and drug insurers, HMOs, government plans, and employer-sponsored group plans. Workers' compensation, automobile, and property or casualty insurers are not health plans. A group plan under fifty participants administered solely by the employer is also excluded, which changes who owes Privacy Rule duties.
Example: An auto insurer requests crash-treatment records. It is not a health plan, so release must rest on another basis, such as the patient's authorization.
Mistake to avoid: Treating a workers' compensation carrier as a health plan when it requests records.
Reference: HHS Summary of the HIPAA Privacy Rule
4. Clearinghouses Acting as Business Associates
Clearinghouses convert nonstandard health information into standard formats, or the reverse. When they process data for a plan or provider, they generally function as business associates, and only certain Privacy Rule provisions apply to them. Classify the clearinghouse by its current role before deciding which obligations attach.
Example: A repricing company handles claims for a hospital. Treat it as the hospital's business associate with an agreement, not as a fully independent covered entity.
Mistake to avoid: Applying every covered-entity duty to a clearinghouse that is serving as a business associate.
Reference: HHS Summary of the HIPAA Privacy Rule
5. State Law Preemption and Greater Protection
Federal rules preempt contrary state law—where complying with both is impossible or state law obstructs HIPAA's purposes. Exceptions exist for state laws giving greater privacy protection, laws on reporting disease, injury, abuse, birth, or death, and certain plan reporting. Always compare protections before choosing which law governs.
Example: A state law bars disclosing mental health records without extra consent. It is not preempted because it is more protective, so the stricter state rule controls.
Mistake to avoid: Defaulting to the federal rule when a more protective state privacy statute actually controls the disclosure.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline; HHS Summary of the HIPAA Privacy Rule
6. Officer as Interpretive Resource and Retention Duties
The privacy or security officer serves as the organization's resource for interpreting privacy and security laws, regulations, and accreditation standards. Compliance must be demonstrable through documentation, production, and retention practices required by state and federal law and accrediting agencies, so guidance should map each record type to its retention basis.
Example: A surveyor asks how long operative reports are kept. The officer presents a retention schedule tying each record type to the controlling state and federal requirements.
Mistake to avoid: Maintaining only HIPAA compliance files while state record-retention mandates go untracked and unmet.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
PHI Boundaries, De-identification, and Limited Data Sets
7. PHI Exists in Every Medium
Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate in any form—electronic, paper, or oral. It includes demographic data relating to health, care, or payment that identifies someone or could reasonably be used to identify them.
Example: A staff member discusses a named patient's diagnosis aloud in an elevator. That oral exchange is PHI, so safeguards and minimum necessary still apply.
Mistake to avoid: Believing only records stored in electronic systems count as protected health information.
Reference: HHS Summary of the HIPAA Privacy Rule
8. Employment and Education Record Exclusions
Employment records a covered entity maintains in its role as employer, and education records covered by FERPA, fall outside PHI. The same person's information can be PHI when created in a treatment relationship, so classify by the capacity in which the entity holds the record, not by the person's identity.
Example: A hospital keeps an HR attendance file on a nurse and treats her as a patient. Only the treatment record is PHI subject to patient access rights.
Mistake to avoid: Processing an HR employment file as though it were a patient's designated record set.
Reference: HHS Summary of the HIPAA Privacy Rule
9. Safe Harbor De-identification Requirements
Safe harbor de-identification requires removing specified identifiers of the individual and of relatives, household members, and employers—names, geography smaller than a state, full dates, telephone numbers, medical record numbers, biometrics, and full-face images. It is adequate only if the entity has no actual knowledge the remainder could identify someone.
Example: A registry dataset keeps admission dates and exact ages over eighty-nine. It fails safe harbor, so those date elements and ages must be removed or aggregated.
Mistake to avoid: Calling a dataset de-identified while admission dates and precise elderly ages remain.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
10. Expert Statistical Determination Alternative
A formal determination by a qualified statistician offers a second de-identification path: the expert concludes the residual information cannot reasonably identify individuals, so the full identifier-removal list is unnecessary. Choose this route when keeping some elements, such as partial geography, has analytical value and risk is demonstrably small.
Example: A rural health study needs town-level data. A statistician certifies re-identification risk is very small, allowing release without stripping every safe-harbor element.
Mistake to avoid: Assuming the identifier-removal list is the only valid method of de-identifying a dataset.
Reference: HHS Summary of the HIPAA Privacy Rule
11. Limited Data Set Boundaries
A limited data set is PHI with direct identifiers removed—names, postal addresses beyond town or city, phone numbers, email, Social Security and record numbers, biometrics, and full-face images—but dates and general geography may remain. It is still PHI, usable only for research, public health, or health care operations.
Example: A researcher needs admission dates for a utilization study. A limited data set with a data use agreement preserves those dates, which full de-identification would destroy.
Mistake to avoid: Treating a limited data set as de-identified and sharing it without restrictions.
Reference: HHS Summary of the HIPAA Privacy Rule
12. Data Use Agreement Safeguards
Before releasing a limited data set, obtain a data use agreement in which the recipient promises specified safeguards, uses the data only for the agreed purpose, and agrees not to re-identify or contact individuals. The agreement is the control that distinguishes a permitted release from an unauthorized disclosure.
Example: A university wants census data appended to a limited data set. The officer checks the agreement first; if re-identification is barred, the request must be refused.
Mistake to avoid: Releasing a limited data set on an informal confidentiality promise instead of an agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
Permitted Uses for Treatment, Payment, and Operations
13. Treatment, Payment, and Operations Defined
Treatment covers providing, coordinating, or managing care, including consultation between providers and referrals. Payment covers obtaining premiums, determining coverage, and securing reimbursement. Operations cover quality assessment, credentialing, audits, legal services, business planning, and de-identification. Matching a disclosure to the correct category determines whether authorization is needed.
Example: A primary care physician phones a cardiologist about a shared patient. This is treatment consultation, permitted without authorization, because provider consultation is treatment.
Mistake to avoid: Demanding a signed authorization before a routine referral or provider-to-provider consultation.
Reference: HHS Summary of the HIPAA Privacy Rule
14. Disclosures for Another Entity's Treatment, Payment, or Operations
A covered entity may disclose PHI for the treatment activities of any provider, the payment activities of another covered entity, or certain operations—quality assurance and fraud and abuse detection—only if both entities have or had a relationship with the individual and the PHI pertains to that relationship.
Example: A health plan requests records to audit a claim it paid. Both had a relationship with the patient, so this payment disclosure is permitted without authorization.
Mistake to avoid: Releasing records for another entity's operations when that entity never had a relationship with the patient.
Reference: HHS Summary of the HIPAA Privacy Rule
15. Opportunity to Agree or Object
Informal permission suffices for some disclosures: ask the individual outright, or rely on circumstances that clearly give the chance to agree, acquiesce, or object. When the individual is incapacitated, in an emergency, or unavailable, disclose only what professional judgment deems in the individual's best interest.
Example: An unconscious patient's spouse asks about her condition. Staff may share information relevant to his involvement in her care, using best-interest judgment.
Mistake to avoid: Insisting on a written authorization before any conversation with an involved family caregiver.
Reference: HHS Summary of the HIPAA Privacy Rule
16. Facility Directory Disclosures
A facility may list a patient's name, general condition, location, and religious affiliation based on informal permission, and disclose condition and location to people who ask for the patient by name, and religious affiliation to clergy—who need not ask by name. Without a name-based inquiry, directory disclosure is not permitted.
Example: A caller asks about 'the woman in room nine' without naming her. Staff cannot confirm anything, because directory disclosures require an inquiry by name.
Mistake to avoid: Confirming a patient's presence to a caller who never states the patient's name.
Reference: HHS Summary of the HIPAA Privacy Rule
17. Incidental Disclosures With Reasonable Safeguards
A use or disclosure that occurs as a byproduct of an otherwise permitted one is allowed if the entity has adopted reasonable safeguards and limited the shared information to the minimum necessary. The Rule does not demand elimination of every risk of incidental exposure.
Example: A receptionist calls a patient's name in a waiting room. This is incidental to treatment operations, and safeguards make it permissible rather than reportable.
Mistake to avoid: Labeling every overheard fragment a breach without checking safeguards and minimum necessary.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
18. Minimum Necessary and Its Exceptions
Entities must make reasonable efforts to use, disclose, or request only the PHI needed for the purpose; an entire medical record is justified only when specifically needed. The standard does not apply to treatment disclosures, disclosures to the individual, authorization-based uses, HHS requests, or legally required disclosures.
Example: A payer requests the complete chart to review one claim line. Minimum necessary applies to payment, so staff send only the relevant encounter unless full-record need is shown.
Mistake to avoid: Sending the whole chart automatically because the requester is another covered entity.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
Public Interest and Special-Purpose Disclosures
19. The Only Two Required Disclosures
A covered entity must disclose PHI in only two situations: to individuals or their personal representatives who request access or an accounting of disclosures, and to HHS when it undertakes a compliance investigation, review, or enforcement action. Everything else is a choice governed by the permission rules.
Example: A state investigator demands records without legal process. This is not a required disclosure; evaluate it under law-enforcement conditions before releasing anything.
Mistake to avoid: Treating every government records request as though HIPAA compelled immediate release.
Reference: HHS Summary of the HIPAA Privacy Rule
20. Public Health Disclosures
PHI may go to public health authorities authorized to collect it for preventing or controlling disease, injury, or disability; to child abuse reporting authorities; to FDA-regulated entities for adverse events, tracking, and recalls; and to individuals exposed to a communicable disease when notification is authorized by law.
Example: A lab confirms a reportable infection. Notifying the county health authority is a permitted public health disclosure; no patient authorization is needed.
Mistake to avoid: Holding a legally authorized disease control report until the patient signs an authorization.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
21. Health Oversight and Judicial Requests
Disclosures to health oversight agencies for audits, investigations, and system oversight are permitted. In judicial or administrative proceedings, release requires a court or tribunal order, or a subpoena or other lawful process accompanied by assurances that the individual was notified or a protective order was obtained.
Example: A subpoena arrives with no notice to the patient and no protective order. Staff should withhold records until satisfactory assurances are provided.
Mistake to avoid: Releasing records on a bare subpoena that lacks notice or protective-order assurances.
Reference: HHS Summary of the HIPAA Privacy Rule
22. Law Enforcement Disclosure Conditions
Law enforcement disclosures fit six circumstances: as required by law; to identify or locate a suspect, fugitive, material witness, or missing person; for a victim's request; to report a suspicious death; for crime evidence on the premises; and for off-premises medical emergencies. Each carries its own conditions.
Example: An officer seeks a witness's address. Disclosure fits the identify-or-locate purpose only, so staff limit what is shared to that narrow need.
Mistake to avoid: Granting broad chart access when the request fits only a narrow law-enforcement purpose.
Reference: HHS Summary of the HIPAA Privacy Rule
23. Research Access Without Authorization
Three routes allow research use without authorization: documentation of an IRB or Privacy Board approved waiver or alteration; representations that access is solely preparatory—designing a protocol, removing no PHI, and requesting only necessary records; and representations that research concerns only decedents, with death documentation on request.
Example: A researcher reviews charts to draft a study design. Preparatory representations permit the review but prohibit removing any PHI from the entity.
Mistake to avoid: Letting a preparatory-to-research reviewer export or copy data while drafting the protocol.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
24. Serious Threats, Decedents, and Workers' Compensation
PHI may be disclosed to prevent or lessen a serious and imminent threat, but only to someone believed able to prevent or lessen it, including the target. Funeral directors, coroners, and medical examiners may receive needed information, and workers' compensation disclosures follow the authorizing law.
Example: A clinician identifies a credible threat against a named person. Warning that person directly is permitted because they can lessen the threat.
Mistake to avoid: Broadcasting a threat warning widely instead of limiting it to those able to act.
Reference: HHS Summary of the HIPAA Privacy Rule
Individual Rights and the Notice of Privacy Practices
25. Notice of Privacy Practices Content
The notice must describe how the entity may use and disclose PHI, state its duties to protect privacy and abide by the notice, describe individual rights including complaints to the entity and to HHS, and give a contact point. Entities must act in accordance with their own notice.
Example: A draft notice omits the complaint route to HHS. Fix it before distribution, because the entity is bound to follow what it publishes.
Mistake to avoid: Distributing a notice whose described practices differ from what the entity actually does.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
26. Notice Distribution Timing by Provider Type
Direct treatment providers must deliver the notice by the first service encounter—personally, by automatic electronic response, or by prompt mailing for telephone services—post it at each site, and supply it after emergencies abate. Covered entities must give it to anyone on request and post it on customer-service websites.
Example: A patient registers by phone for a first visit. The practice mails the notice promptly rather than waiting for the in-person appointment.
Mistake to avoid: Waiting for a convenient visit to deliver a notice that was due at first encounter.
Reference: HHS Summary of the HIPAA Privacy Rule
27. Good Faith Acknowledgement of Notice Receipt
Direct treatment providers must make a good faith effort to obtain the patient's written acknowledgement of receiving the notice, document the reason for any failure, and are relieved of asking during emergencies. The Rule prescribes no particular acknowledgement content, so the process record matters more than the form's wording.
Example: A patient declines to sign the acknowledgement. Staff document the refusal as the reason; the good-faith effort still satisfies the duty.
Mistake to avoid: Leaving failed acknowledgements undocumented, with no recorded reason for the gap.
Reference: HHS Summary of the HIPAA Privacy Rule
28. Access Right and the Designated Record Set
Individuals may inspect and copy PHI in the designated record set: records used to make decisions about them, a provider's medical and billing records, or a plan's enrollment, payment, claims, and case management systems. Systems outside these boundaries, such as audit logs, are not reachable through the access right.
Example: A patient demands raw system audit trails. They are not part of the designated record set, so the access right does not extend to them.
Mistake to avoid: Equating every database that stores patient data with the designated record set.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
29. Access Exceptions and Reviewable Denials
Psychotherapy notes, information compiled for legal proceedings, CLIA-prohibited laboratory results, and certain research laboratory records are excepted from access. Harm-based denials—risk to the individual or another person—must be reviewable by a licensed health care professional who did not join the original denial decision.
Example: A clinician denies access fearing harm to the patient. The patient must be offered review by a different licensed professional before the denial stands.
Mistake to avoid: Denying access on harm grounds and never offering the required independent professional review.
Reference: HHS Summary of the HIPAA Privacy Rule
30. Amendment Rights and Accounting of Disclosures
Individuals may request amendment of inaccurate or incomplete PHI in the designated record set; a denial requires written notice and the chance to file a statement of disagreement. Accounting covers the six prior years and excludes treatment, payment, operations, individual, authorization, directory, and limited data set disclosures.
Example: A patient disputes a recorded allergy. If denied, the entity files his disagreement statement; a later accounting must still list an oversight-agency disclosure.
Mistake to avoid: Dropping health oversight disclosures from an accounting because they seemed like routine business.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
Authorizations, Marketing, and Sensitive Records
31. When Written Authorization Is Required
Any use or disclosure outside treatment, payment, operations, and the other permitted categories requires the individual's written authorization. Classic examples include disclosures to a life insurer for coverage, an employer receiving pre-employment physical results, and a pharmaceutical firm's own marketing uses.
Example: A life insurer wants an exam's results. Release requires authorization, and the provider may condition performing that exam on the patient signing it.
Mistake to avoid: Sending pre-employment examination results to an employer with no authorization on file.
Reference: HHS Summary of the HIPAA Privacy Rule
32. Authorization Content and Revocation Terms
Authorizations must be written in plain language and specify the information involved, who discloses and who receives it, an expiration, the right to revoke in writing, and other required elements. A form missing any core element is invalid, so verification precedes any release.
Example: An authorization names no recipient and has no expiration date. Staff return it for correction; nothing is released under the defective form.
Mistake to avoid: Accepting a vague authorization that never identifies who receives the information.
Reference: HHS Summary of the HIPAA Privacy Rule
33. Limits on Conditioning Care on Authorization
Entities generally may not condition treatment, payment, enrollment, or eligibility on obtaining an authorization. Narrow exceptions exist: health care provided solely to generate PHI for a third party, plan enrollment or eligibility requests made before enrollment, and research-related treatment such as clinical trials.
Example: A practice refuses routine care unless the patient signs a marketing authorization. That conditioning is improper because marketing fits no exception.
Mistake to avoid: Tying everyday treatment to signing an unrelated authorization for marketing purposes.
Reference: HHS Summary of the HIPAA Privacy Rule
34. What Counts as Psychotherapy Notes
Psychotherapy notes are a mental health professional's notes analyzing the contents of a private, group, joint, or family counseling session, kept separate from the rest of the record. Medication prescription and monitoring, session start and stop times, treatment frequency, test results, and diagnostic summaries are excluded.
Example: Session timing entries stay in the main chart. They are not psychotherapy notes, so ordinary treatment use needs no special authorization.
Mistake to avoid: Treating medication monitoring entries as psychotherapy notes that need an authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
35. Psychotherapy Notes Exceptions to Authorization
Authorization is required for psychotherapy notes except when the originator uses them for treatment, the entity uses them for its own training or to defend proceedings the individual brought, HHS investigates compliance, a serious imminent threat must be averted, lawful oversight of the originator occurs, or law requires disclosure.
Example: A therapist reviews her own earlier notes before a follow-up session. That originator treatment use is permitted without any authorization.
Mistake to avoid: Demanding an authorization when the originating therapist consults their own session notes.
Reference: HHS Summary of the HIPAA Privacy Rule
36. Marketing Rules and Remuneration Disclosure
Marketing means communications encouraging purchase or use of a product or service. Carve-outs include the entity's own health services and benefit descriptions, network provider listings, treatment communications, and case management. Authorization is required except for face-to-face communications and nominal promotional gifts; paid marketing authorizations must reveal the remuneration.
Example: A hospital newsletter promotes its own new clinic—no authorization needed. A paid advertisement for an outside device maker requires an authorization disclosing the payment.
Mistake to avoid: Handling a remunerated third-party promotion as though it were treatment communication.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
Business Associates and Agreement Management
37. Who Qualifies as a Business Associate
A business associate is a non-workforce person or organization performing functions for a covered entity that involve PHI use or disclosure—claims processing, data analysis, utilization review, billing—or providing legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services.
Example: An outside firm handles the practice's claims processing. It is a business associate, so a written agreement is required before any PHI flows.
Mistake to avoid: Treating a contractor as outside privacy rules because it is a vendor.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
38. Incidental Access Does Not Create a Business Associate
A person or organization is not a business associate when its functions or services do not involve PHI use or disclosure, and any access would be incidental at most. Distinguishing incidental exposure from PHI-dependent services decides whether an agreement is needed at all.
Example: A landscaping crew works near a records storage room. Their potential glimpse is incidental, so safeguards—not a business associate agreement—address the risk.
Mistake to avoid: Signing business associate agreements with every vendor regardless of any PHI involvement.
Reference: HHS Summary of the HIPAA Privacy Rule
39. Required Protections in a Business Associate Agreement
The agreement must impose specified written safeguards on the individually identifiable information the associate uses or discloses. A covered entity may not contractually authorize the associate to make any use or disclosure that would violate the Rule, so agreement language broader than the Rule is unacceptable.
Example: A draft agreement lets a consultant mine PHI to build its own product. Reject it; no contract can authorize what the Privacy Rule forbids.
Mistake to avoid: Accepting agreement language that grants the associate uses the Privacy Rule prohibits.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
40. Covered Entities as Business Associates of Each Other
A covered entity can serve as the business associate of another covered entity. When one entity performs services involving PHI on behalf of the other, the service relationship—not covered-entity status alone—controls, and an agreement is still needed between them.
Example: A health plan processes billing services for a physician group. For that service the plan is the group's business associate and signs an agreement.
Mistake to avoid: Assuming two covered entities never need a business associate agreement between them.
Reference: HHS Summary of the HIPAA Privacy Rule
41. Service Level Agreements and Incident Oversight of Associates
Program management covers securing appropriate agreements—business associate agreements and service level agreements—and assessing and communicating the risks of privacy or security incidents, including incidents caused by business associates, to designated leadership. Vendor performance failures can also be privacy incidents requiring escalation.
Example: A hosting vendor repeatedly misses uptime commitments. Beyond service-level remedies, the officer evaluates whether outages exposed PHI and escalates the risk.
Mistake to avoid: Managing vendor failures purely as contract matters and skipping privacy incident escalation.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline; Certified in Healthcare Privacy and Security (CHPS)
42. Governmental Alternatives to Standard Agreements
In certain circumstances governmental entities may use alternative means to achieve the same protections a business associate agreement would provide. Evaluate whether the alternative instrument delivers equivalent safeguards rather than rejecting it solely for lacking the standard agreement's form.
Example: A county agency performs data processing for a public hospital under an equivalent protective arrangement. Accept it if the safeguards match agreement-level protections.
Mistake to avoid: Rejecting a government arrangement only because it is not titled a business associate agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
Security Safeguards: Administrative, Physical, and Technical
43. Security Plan Scope Under 45 CFR 164.306
The information security plan must be developed and managed with consideration of 45 CFR 164.306, and policies must protect the integrity, availability, and confidentiality of health information communicated across networks. A plan addressing only confidentiality leaves availability and integrity exposures unmanaged.
Example: A new telehealth platform is approved. The plan update must cover all three properties, since a confidential system that is unavailable still fails patients.
Mistake to avoid: Building the security plan around confidentiality alone while ignoring availability and integrity.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline; Certified in Healthcare Privacy and Security (CHPS)
44. Administrative Safeguards Through Training and Awareness
Administrative safeguards require developing, delivering, evaluating, and documenting privacy and security training, educating the workforce on policy changes, and monitoring compliance with technical, physical, and administrative safeguards. Undocumented training cannot demonstrate an informed workforce when compliance is questioned.
Example: A remote-access policy is revised. Affected staff are retrained and completions recorded, so the organization can prove the workforce was informed.
Mistake to avoid: Counting one orientation session as the entire ongoing workforce education program.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
45. Physical Safeguards and Media Control
Physical safeguards include a facility security plan preventing unauthorized physical access, theft, or tampering, and monitoring mechanisms that limit unauthorized personnel access to facilities, equipment, and information. Media control governs receipt, removal, reuse, and internal or external destruction of media and devices holding sensitive data.
Example: Decommissioned file-server drives are hauled away untracked. Media control practices require documented removal and destruction, not simply trusting the recycler.
Mistake to avoid: Disposing of storage media with no documented removal, reuse, or destruction record.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
46. Access Authorization, Authentication, and Emergency Access
Technical access management requires verifying and controlling access authorizations, authentication mechanisms, and privileges, including emergency access. Privileges should track current duties, and emergency pathways must exist yet remain controlled and reviewable so urgent care needs do not become permanent exposure.
Example: A clinician takes extended leave, so her account is suspended. The emergency override account stays available but every use is logged for review.
Mistake to avoid: Leaving dormant accounts active indefinitely because no complaint has ever surfaced.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
47. Technical Safeguards for Electronic PHI
Technical safeguards require assessing and monitoring mechanisms that control access and protect electronic protected health information. Protection is layered: authentication restricts who enters, session controls limit what is exposed, and monitoring detects misuse, so a single control is never sufficient.
Example: A shared ward workstation holds records. Unique logins with automatic timeout limit exposure far better than a posted sign asking users to log off.
Mistake to avoid: Relying on physical locks and policy reminders alone to protect electronic records.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
48. Protecting Transmissions To and From External Users
Appropriate technologies must protect information received from or transmitted to external users. Because data in transit crosses boundaries the organization does not control, the sending side must verify the protection method before release rather than assuming the recipient's environment is safe.
Example: Records are sent to an outside specialist's portal. Staff confirm the transmission is protected before releasing, despite the specialist's urgency.
Mistake to avoid: Emailing unprotected PHI to an external address because the recipient asked for speed.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
Risk Analysis, Monitoring, and Continuity Planning
49. Ongoing Risk Assessment for Existing Systems
Risk assessment is not a one-time implementation task: ongoing assessments are required for existing information systems containing PHI. Recurring review catches drift—new interfaces, changed user roles, accumulated data—that the original analysis never contemplated.
Example: An annual review finds a legacy interface now over-shares chart data. Because assessment is recurring, the gap is caught and remediated.
Mistake to avoid: Treating the go-live risk analysis as permanently sufficient for a live system.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
50. Assessing New Systems Before Adoption
New information systems containing PHI require assessment of their risks and criticalities. The evaluation should occur as part of selection and implementation, so weaknesses are addressed before patient data lands in the system rather than discovered after go-live.
Example: A patient portal is proposed. The team assesses what data it exposes and how critical outages would be before approving launch.
Mistake to avoid: Launching a new PHI system and assessing its risks only after complaints arrive.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
51. Event Triggers for Abnormal Network Conditions
Security monitoring must identify event triggers for abnormal conditions—intrusion detection, denial of service, and invalid log-on attempts. Triggers convert raw system noise into actionable alerts, so tuning matters: alerts that fire on everything are ignored, and alerts that fire on nothing detect nothing.
Example: Repeated failed logins occur at unusual overnight hours. A configured trigger flags them for review as a possible intrusion attempt.
Mistake to avoid: Disabling noisy alerts entirely and leaving no trigger coverage for genuine attacks.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
52. Monitoring and Auditing PHI Access
Compliance programs must monitor and audit access to protected health information. Auditing internal access patterns matters as much as watching external threats, because curiosity browsing of acquaintances' records is a common violation that only access logs reveal.
Example: An audit shows a clerk opened a neighbor's chart. The finding triggers investigation regardless of intent, because unauthorized access is a violation.
Mistake to avoid: Auditing external breaches only and never reviewing internal record access patterns.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
53. Continuity for Planned Downtime Versus Emergencies
Business continuity planning covers planned downtime, while contingency planning addresses emergencies and disaster recovery. The distinction drives preparation: planned downtime is scheduled and communicated with workarounds, whereas emergencies demand rapid response when systems fail unexpectedly.
Example: A scheduled EHR upgrade uses paper fallback procedures announced in advance. A fire in the server room instead invokes disaster recovery.
Mistake to avoid: Using a single disaster plan to cover both scheduled maintenance and true emergencies.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
54. Asset Inventory as the Basis for Risk Analysis
An inventory of software, hardware, and all data must be developed and maintained to protect information assets and facilitate risk analysis. Unknown assets are unassessed assets, so inventory gaps translate directly into unmanaged risk exposure.
Example: A departmental database holding PHI is discovered outside official systems. It is added to the inventory so it enters the assessment cycle.
Mistake to avoid: Running risk analyses against an incomplete or long-outdated inventory of assets.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
Incident Response, Breach Notification, and Enforcement
55. Establishing the Incident Investigation Process
An incident and complaint investigation process must be established, along with a response plan to mitigate privacy or security incidents. A defined process assigns triage, escalation, and documentation duties in advance, so incidents are handled consistently rather than improvised.
Example: A fax with patient details reaches a wrong clinic. Staff triage it under the incident process, which sets mitigation steps and required documentation.
Mistake to avoid: Handling incidents ad hoc without any defined escalation or documentation path.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
56. Workforce Knowledge of Incident Reporting
The workforce must know how to report a potential privacy or security incident. Reporting channels that staff actually understand turn early observations—misdirected faxes, unattended screens, suspicious emails—into quick investigations instead of unaddressed risks.
Example: A nurse spots a chart left in a public lobby. Because the reporting channel is known, the observation reaches the privacy officer promptly.
Mistake to avoid: Leaving staff unsure where to report, so incidents surface only through complaints.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
57. Risk Assessment for Breach Notification
A risk assessment must be performed for breach notification. The assessment weighs what information was involved, how it was exposed, and what protections applied, producing a documented basis for the notification decision rather than an instinctive one.
Example: A laptop is lost with patient files on it. The officer assesses the data involved and protections in place, documenting whether notification is required.
Mistake to avoid: Deciding notification by instinct and leaving no documented assessment to support it.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
58. Notification Parties and Timeframes
Breach notification policy must ensure the appropriate individuals, agencies, and, where applicable, media are notified within the required timeframe. Planning the recipient list in advance prevents a common failure: notifying patients while missing regulator or media obligations.
Example: A large breach is confirmed. The response plan reaches affected individuals plus the required agencies and media within the notification window.
Mistake to avoid: Notifying patients while missing the required agency or media notifications on time.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
59. Documentation and Coordinated External Responses
Appropriate documentation must be maintained for breach notification, and responses to inquiries and investigations from external entities must be coordinated so replies are consistent with organizational policies and delivered within required timeframes. Central coordination prevents contradictory departmental answers to regulators.
Example: A regulator's letter arrives. It is routed through the coordination process so one consistent, timely response is produced for the whole organization.
Mistake to avoid: Letting individual departments answer external regulators directly, without any coordination.
Reference: AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
60. Enforcement Exposure and Correction Windows
OCR enforces the Privacy Rule through complaint investigations, compliance reviews, and civil money penalties, with amounts varying by factors such as knowledge and willful neglect; criminal exposure rises with false pretenses or commercial advantage. A failure not due to willful neglect, corrected within thirty days, may bar a penalty.
Example: An entity discovers a noncompliant practice, confirms it was not willful neglect, and corrects it within thirty days. The correction window can bar a penalty.
Mistake to avoid: Ignoring a known deficiency past the correction window, converting it into willful neglect.
Reference: HHS Summary of the HIPAA Privacy Rule; AHIMA: Certified in Healthcare Privacy and Security (CHPS) exam content outline
References and further reading
Source links checked on Oct 2, 2026.