Free CHPS examination Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CHPS examination practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Under the HIPAA Privacy Rule, who is responsible for developing and implementing a covered entity's privacy policies and procedures?

   1. A. The designated privacy official
   2. B. The designated security official
   3. C. The notice distribution coordinator
   4. D. The external complaint investigator

   Answer: A

   Explanation: HHS states, "A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures". This assigns the policy role to the privacy official; the security official has a different Security Rule role.

   Reference: HHS Summary of the HIPAA Privacy Rule — Administrative Requirements / Privacy Personnel

2. 2When must a covered provider with a direct treatment relationship give an NPP to a patient seen in person?

   1. A. At the first service encounter or earlier
   2. B. Only when the patient later requests it
   3. C. Only after the first claim is paid
   4. D. Only when the patient changes providers

   Answer: A

   Explanation: HHS specifies NPP delivery "Not later than the first service encounter by personal delivery (for patient visits)". The in-person visit calls for this timing.

   Reference: HHS Summary of the HIPAA Privacy Rule — Notice and Other Individual Rights / Notice Distribution

3. 3In developing an information security plan under § 164.306, which ePHI lifecycle activities must the plan cover?

   1. A. Only ePHI that the entity created inside its own network
   2. B. Only ePHI received from partner organizations
   3. C. ePHI the entity creates, receives, maintains, or transmits
   4. D. Only ePHI stored in its primary electronic health record

   Answer: C

   Explanation: Section 164.306(a)(1) covers the complete ePHI lifecycle: "Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits." The plan cannot exclude one of those activities.

   Reference: 45 CFR § 164.306, Security standards: General rules (eCFR) — § 164.306(a)(1) General requirements

4. 4A covered entity tailors its privacy procedure to its small size, but the procedure still permits a disclosure forbidden by the Privacy Rule. Can the tailoring excuse that disclosure?

   1. A. Yes; a documented policy may authorize any PHI disclosure
   2. B. No; flexibility in policy design does not permit a Rule violation
   3. C. Yes; naming a privacy official overrides disclosure limits
   4. D. No; but only because the entity has a small workforce

   Answer: B

   Explanation: Size-sensitive policy design does not excuse substantive noncompliance. Section 164.530(i)(1) states "This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirement of this subpart."

   Reference: 45 CFR § 164.530, Administrative requirements (eCFR) — § 164.530(i)(1) Policies and procedures

5. 5Which role must a covered entity designate to receive privacy complaints and provide information about its privacy practices?

   1. A. A contact person or contact office
   2. B. A security risk analyst
   3. C. An information system owner
   4. D. An external accreditation reviewer

   Answer: A

   Explanation: The Privacy Rule summary specifies "a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity's privacy practices." The complaint and information function is therefore assigned to this contact role.

   Reference: HHS Summary of the HIPAA Privacy Rule — Administrative Requirements / Privacy Personnel

6. 6How must a direct treatment provider display its Notice of Privacy Practices at a service site?

   1. A. In a restricted staff area where patients cannot read it
   2. B. In a prominent location where patients seeking service can read it
   3. C. In a claims office that patients do not routinely enter
   4. D. On an internal site accessible only with staff credentials

   Answer: B

   Explanation: HHS requires posting "at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice". A staff-only posting would not meet that access condition.

   Reference: HHS Summary of the HIPAA Privacy Rule — Notice and Other Individual Rights / Notice Distribution

7. 7What class of threat must a Security Rule plan address under § 164.306(a)(2)?

   1. A. Only threats already shown to have caused a documented breach
   2. B. Only threats specifically identified by a technology vendor
   3. C. Reasonably anticipated threats or hazards to ePHI
   4. D. Every imaginable threat, even one without plausible likelihood

   Answer: C

   Explanation: The regulation says entities must "Protect against any reasonably anticipated threats or hazards to the security or integrity of such information." This is an anticipated-risk duty, not a past-breach-only or boundless rule.

   Reference: 45 CFR § 164.306, Security standards: General rules (eCFR) — § 164.306(a)(2) Anticipated threats

8. 8When evaluating whether a covered entity's privacy policies are reasonably designed for compliance, which organizational characteristics matter under the rule?

   1. A. Its annual revenue and the number of technology vendors
   2. B. The age and physical size of its primary building
   3. C. Its size and the type of PHI activities it undertakes
   4. D. Whether it has a privacy official physically on site

   Answer: C

   Explanation: Policy design must reflect the entity's size and PHI-related activities, not an unrelated business metric. The official source states "taking into account the size and the type of activities that relate to protected health information undertaken by a covered entity"

   Reference: 45 CFR § 164.530, Administrative requirements (eCFR) — § 164.530(i)(1) Policies and procedures

9. 9What is the designated security official's responsibility under the HIPAA Security Rule?

   1. A. Developing and implementing Security Rule policies
   2. B. Deciding every request to amend a patient's record
   3. C. Receiving every complaint about privacy practices
   4. D. Distributing privacy notices to all new patients

   Answer: A

   Explanation: HHS states, "A regulated entity must designate a security official responsible for developing and implementing the policies and procedures required by the Security Rule." The other options concern separate privacy administration tasks.

   Reference: HHS Summary of the HIPAA Security Rule — Administrative Safeguards / Assigned Security Responsibility

10. 10During emergency treatment, when should a direct treatment provider furnish its privacy practices notice?

    1. A. Before any emergency care may begin
    2. B. Only if the patient asks after discharge
    3. C. As soon as practicable after the emergency abates
    4. D. At the next three-year enrollment reminder

    Answer: C

    Explanation: HHS specifies, "In emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates." This preserves the emergency exception without eliminating notice delivery.

    Reference: HHS Summary of the HIPAA Privacy Rule — Notice and Other Individual Rights / Notice Distribution