CHPS examination — Information & Free Practice

The authority publishes percentage ranges for each content area. The practice percentages below use the midpoint of each range, normalized to 100%; they are not exact percentages published by the authority. Practice question counts may differ slightly because of rounding.

• Ethical, Legal, and Regulatory Issues / Environmental Assessment — Official range: 10–18% (Practice allocation: 14%)

  • Privacy and security officer responsibilities
  • Interpret privacy and security laws and standards
  • State privacy preemption
  • Health information exchange policies
  • Compliance documentation, production and retention
  • PHI access during a public health emergency
• Privacy and Security Program Management and Administration — Official range: 30–40% (Practice allocation: 35%)

  • Notice of Privacy Practices distribution
  • Patient rights requests
  • Business associate contracts and agreements
  • Facility security plan
  • Preventive breach program
  • Workforce privacy and security training
  • Workforce education on policy changes
  • Research uses and disclosures
  • De-identification processes
  • Incident risk communication
  • Requester authorization for PHI access
  • Minimum necessary standard
  • HIPAA-designated record sets and release requests
  • Special privacy protection records
  • Marketing and fundraising disclosures
• Information Technology / Physical and Technical Safeguards — Official range: 24–35% (Practice allocation: 29.5%)

  • Information security plan and 45 CFR 164.306
  • Network information integrity, availability and confidentiality
  • Incidental disclosure safeguards
  • Business continuity and disaster recovery
  • Privacy and security solutions
  • Compliance with technical, physical and administrative safeguards
  • Risk of new PHI information systems
  • Physical security mechanisms
  • Technical security mechanisms for electronic PHI
  • Risk assessment of existing PHI information systems
  • Protection of information exchanged with external users
  • Access authorizations, authentication and privileges
  • Abnormal network event triggers
  • Media control and disposal
  • Software, hardware and data inventory
• Investigation, Compliance, and Enforcement — Official range: 19–24% (Practice allocation: 21.5%)

  • Routine state and federal compliance monitoring
  • Breach notification policy
  • Incident investigation and mitigation response
  • Workforce incident reporting
  • Privacy and security policy enforcement
  • PHI access monitoring and audit
  • Breach notification risk assessment
  • External inquiry and investigation response
  • Notifications to individuals, agencies and media
  • Breach notification documentation