OpenExamsFREE PRACTICE — ANY EXAM

Certified in Healthcare Privacy and Security — Requirements & Free Practice

US · License preparation

200 free questions · Answer explanations · No signup required

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Loading selected examination banks…

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Certified in Healthcare Privacy and Security

AHIMA professional certification in healthcare privacy and security.

Licensing authority: The Commission on Certification for Health Informatics and Information Management (CCHIIM) · Application information

Initial by examination
CHPS examination
Eligibility Alternatives
["High school or GED and six years of healthcare privacy or security experience","Relevant associate degree and four years of healthcare privacy or security experience","CCA, CCS, CCS-P, or RHIT and four years of healthcare privacy or security experience","Relevant baccalaureate degree and two years of healthcare privacy or security experience","RHIA and two years of healthcare privacy or security experience","Relevant master's degree or higher and one year of healthcare privacy or security experience"]

CHPS examination

Exam questions
Total questions: 150; Scored questions: 125; Unscored questions: 25; The total includes the scored and unscored questions.
Examination outline

The authority publishes percentage ranges for each content area. The practice percentages below use the midpoint of each range, normalized to 100%; they are not exact percentages published by the authority. Practice question counts may differ slightly because of rounding.

  • Ethical, Legal, and Regulatory Issues / Environmental Assessment — Official range: 10–18% (Practice allocation: 14%)
    • Privacy and security officer responsibilities
    • Interpret privacy and security laws and standards
    • State privacy preemption
    • Health information exchange policies
    • Compliance documentation, production and retention
    • PHI access during a public health emergency
  • Privacy and Security Program Management and Administration — Official range: 30–40% (Practice allocation: 35%)
    • Notice of Privacy Practices distribution
    • Patient rights requests
    • Business associate contracts and agreements
    • Facility security plan
    • Preventive breach program
    • Workforce privacy and security training
    • Workforce education on policy changes
    • Research uses and disclosures
    • De-identification processes
    • Incident risk communication
    • Requester authorization for PHI access
    • Minimum necessary standard
    • HIPAA-designated record sets and release requests
    • Special privacy protection records
    • Marketing and fundraising disclosures
  • Information Technology / Physical and Technical Safeguards — Official range: 24–35% (Practice allocation: 29.5%)
    • Information security plan and 45 CFR 164.306
    • Network information integrity, availability and confidentiality
    • Incidental disclosure safeguards
    • Business continuity and disaster recovery
    • Privacy and security solutions
    • Compliance with technical, physical and administrative safeguards
    • Risk of new PHI information systems
    • Physical security mechanisms
    • Technical security mechanisms for electronic PHI
    • Risk assessment of existing PHI information systems
    • Protection of information exchanged with external users
    • Access authorizations, authentication and privileges
    • Abnormal network event triggers
    • Media control and disposal
    • Software, hardware and data inventory
  • Investigation, Compliance, and Enforcement — Official range: 19–24% (Practice allocation: 21.5%)
    • Routine state and federal compliance monitoring
    • Breach notification policy
    • Incident investigation and mitigation response
    • Workforce incident reporting
    • Privacy and security policy enforcement
    • PHI access monitoring and audit
    • Breach notification risk assessment
    • External inquiry and investigation response
    • Notifications to individuals, agencies and media
    • Breach notification documentation
Examination sources