CHP study plan

Define the core privacy concepts (PHI, covered entity, business associate, treatment/payment/operations) in your own words without notes

Map each major legal source (federal privacy rule, breach rules, state laws, HIPAA-adjacent statutes) to its scope and who it binds

Build a one-page glossary of at least 25 terms with citations to the source provision for each

Identify three scenarios where federal and state privacy rules conflict and note which controls

Trace the permitted-use categories and match each to a concrete hospital workflow example

Distinguish required vs. permitted disclosures and write the rule for each

Draft a decision tree that routes a disclosure request to permitted, authorized, or prohibited

List the exceptions to general disclosure limits and state the condition that triggers each

Compare consent, authorization, and minimum-necessary standards and articulate when each applies

Construct a compliant authorization form checklist with all required elements

Apply the minimum-necessary standard to five sample role-based access scenarios

Identify the exceptions where minimum necessary does not apply and explain why

Enumerate individual rights (access, amendment, accounting, restrictions, confidential communications) and their response timelines

Draft a patient-facing access request process with intake, verification, and response steps

Practice applying denial and appeal rules to three access-request edge cases

Reconcile authorization requirements with individual-rights obligations in a written memo

Define business associate relationships and list the required contract terms

Draft a business associate agreement outline with all mandatory clauses

Map the administrative, physical, and technical safeguard categories to concrete controls

Build a breach risk-assessment worksheet applying the four-factor test to two hypothetical incidents

Outline breach notification obligations by recipient, content, and timeline

Describe the elements of a privacy governance structure (privacy officer, committee, policies)

Draft a privacy program charter identifying roles, reporting lines, and authority

Connect safeguard gaps to governance accountability in a short analysis

Design a privacy risk assessment using a recognized methodology with likelihood and impact scoring

Build an audit plan with sampling approach, frequency, and metrics

Create a monitoring dashboard spec with at least 6 privacy KPIs

Write remediation tracking rules including owner, due date, and escalation

Design a role-based training curriculum with frequency and completion tracking

Draft an incident response playbook covering detection, containment, notification, and lessons learned

Run a tabletop walkthrough of one incident and document gaps found

Complete a full-length timed practice exam and log every missed item by domain