CHP common mistakes
CHP · Understand the traps and how to avoid them.
Treating HIPAA as a single rule and applying the same standard to treatment, payment, and operations disclosures without distinguishing the Privacy Rule's permission structure from the Security Rule's safeguard requirements.
Candidates memorize the acronym and general themes rather than mapping which subrule governs which obligation, so they reach for the Security Rule when asked about a disclosure permission or vice versa.
What to do instead
Before answering, classify the question: is it asking who may use or disclose PHI (Privacy Rule), what safeguards must protect ePHI (Security Rule), or what to do after a compromise (Breach Notification Rule)? Answer only within that subrule's framework.
Assuming a patient's authorization is always required before any use or disclosure of PHI.
Real-world consent habits and state-law intuition lead candidates to default to authorization, overshadowing the many treatment, payment, and health care operations permissions.
What to do instead
For each scenario, first ask whether a permission (TPO, required by law, public health, etc.) already applies; authorization is the fallback, not the default. Reserve authorization analysis for psychotherapy notes, marketing, sale of PHI, and other permission-excluded categories.
Conflating the minimum necessary standard with an absolute requirement, applying it to treatment disclosures or to disclosures to the individual.
The standard is taught as a headline principle, and the exceptions are glossed over, so candidates apply it universally.
What to do instead
Memorize the carve-outs: minimum necessary does not apply to disclosures to or requests by a health care provider for treatment, to the individual, pursuant to a valid authorization, or as required by law. State the exception explicitly in your reasoning.
Missing that a use or disclosure was impermissible because the individual's request for restriction or confidential communications was not honored, or because the individual was not given a requested accounting.
Patient rights questions are read as customer-service issues rather than as legally enforceable obligations with specific timelines and exceptions.
What to do instead
Build a one-page matrix of individual rights (access, amendment, restriction, confidential communications, accounting, copy of record) with who must comply, the deadline, the permitted denial grounds, and the review/appeal path. Drill the deadlines separately.
Failing to identify a business associate relationship when a vendor handles PHI incidentally, or treating a conduit as a business associate.
Candidates rely on job titles or contract labels instead of the functional test of whether the entity creates, receives, maintains, or transmits PHI on behalf of a covered entity.
What to do instead
Apply the functional test and memorize the exclusions (conduit for transport, mere janitorial or similar services with no PHI access). Note that a business associate must flow down equivalent obligations to its own subcontractors.
Misapplying the breach notification risk assessment by skipping the four-factor analysis and jumping straight to a conclusion.
The presumption of breach is underweighted, and candidates substitute a gut check or a single factor (like encryption) for the structured assessment.
What to do instead
Walk the four factors in order: nature and extent of PHI involved, unauthorized recipient, whether PHI was actually acquired or viewed, and extent of risk mitigation. State that breach is presumed unless a low probability of compromise is demonstrated.
Assuming encryption alone satisfies the Security Rule or that a security incident automatically triggers breach notification.
Encryption is overgeneralized as a universal safe harbor, and the distinction between a security incident (which must be tracked and reported internally) and a notifiable breach is blurred.
What to do instead
Separate the concepts: encryption at rest and in transit is an addressable implementation specification that supports a safe harbor only if the data is rendered unusable, unreadable, or indecipherable. A security incident requires documentation and response, but notification depends on the breach definition and risk assessment.
Designing a privacy program as a policy binder without governance elements such as a designated privacy official, workforce training records, sanctions, and documented risk analysis.
Candidates confuse documentation of rules with evidence of an operating program and omit the administrative safeguards that auditors actually test.
What to do instead
For every governance question, structure the answer around assigned accountability, documented policies and procedures, workforce training and sanctions, and periodic risk analysis with remediation tracking. Name the accountable role explicitly.
Treating risk assessment as a one-time compliance exercise rather than an ongoing process tied to changes in systems and operations.
Candidates learn that a risk analysis is required and stop there, missing the requirement that it be periodic and updated when the environment changes.
What to do instead
Frame risk assessment answers as cyclical: inventory ePHI, identify threats and vulnerabilities, assess likelihood and impact, implement and document controls, then monitor and re-assess on a defined schedule and after material changes.
Responding to an incident by focusing only on containment and remediation while neglecting documentation, notification deadlines, and the training and awareness loop that should follow.
Incident response is studied as a technical playbook, and the privacy program's documentation and learning obligations are treated as afterthoughts.
What to do instead
Use a fixed incident checklist: detect and contain, assess and document, notify within the required timeframe to individuals, HHS, and media where applicable, then update training and controls based on root cause. Mention documentation of every incident, including those not notifiable.