CHP study guide
CHP · Work through your exam, one topic at a time.
The Certified in Healthcare Privacy (CHP) credential is designed for professionals who manage or advise on the protection of patient health information - privacy officers, compliance and risk staff, health information management specialists, consultants, and attorneys working with covered entities and their vendors. It signals that a holder understands how privacy obligations are created, governed, operationalized, and defended across a healthcare organization rather than in a single department. The CHP study guide has 9 sections and about 2,938 words.
01Healthcare Privacy Fundamentals and Legal Framework
HIPAA's Privacy Rule governs how covered entities and their business associates handle protected health information (PHI). PHI is individually identifiable health information transmitted or maintained in any form or medium, relating to past, present, or future physical or mental health, care provided, or payment for care.
362 words, about 2 min02Privacy Program Governance and Administration
A privacy program needs formal structure: a designated Privacy Official, documented policies and procedures, a workforce training plan, a complaint process, and a sanctions policy. Governance also includes assigning responsibility for the Security Rule (often a Security Official) and ensuring the two roles coordinate.
310 words, about 2 min03Patient Rights and Individual Access
Individuals have a right to inspect and obtain a copy of their PHI in a designated record set, in the form and format requested if readily producible, including electronic copies. The response deadline is 30 days, with one 30-day extension permitted if the individual is notified in writing of the reason and the date.
357 words, about 2 min04Uses and Disclosures of Protected Health Information
A covered entity may use and disclose PHI for treatment, payment, and healthcare operations (TPO) without authorization. It may also disclose without authorization for specified public-interest purposes: required by law, public health activities, reporting abuse or neglect, health oversight, judicial and administrative proceedings, law enforcement under defined conditions, coroners and funeral directors, organ donation, research with proper approvals or a waiver, to avert a serious threat to health or safety, and for specialized government functions.
300 words, about 2 min05Consent, Authorization, and Minimum Necessary
Consent and authorization are distinct. Consent is a general permission for treatment, payment, and healthcare operations and is governed largely by state law and organizational policy.
340 words, about 2 min06Business Associates and Third-Party Relationships
A business associate is a person or entity that performs functions or activities on behalf of a covered entity involving PHI-such as claims processing, data analysis, billing, or IT support-or that provides legal, actuarial, accounting, consulting, or other services involving PHI. A written business associate agreement (BAA) is required before PHI is shared.
341 words, about 2 min07Security Safeguards and Breach Notification
The Security Rule requires administrative, physical, and technical safeguards for ePHI. Administrative safeguards include risk analysis, workforce security, training, and contingency planning.
322 words, about 2 min08Privacy Risk Assessment, Auditing, and Monitoring
Risk analysis is the foundational activity: identify threats and vulnerabilities to PHI, assess likelihood and impact, and document results. Risk management then applies safeguards proportionate to the risk.
307 words, about 2 min09Training, Awareness, and Incident Response
Workforce training is a required administrative safeguard and Privacy Rule obligation. Training must occur at onboarding and when functions change, and refreshers should be periodic.
299 words, about 1 min