CHPC case studies
CHPC · Put your knowledge to work in context.
The Certified in Healthcare Privacy Compliance (CHPC) credential is a professional certification for people who build, run, or advise on privacy programs in healthcare organizations. It is most often pursued by privacy officers, compliance and risk staff, health information management professionals, in-house counsel, consultants, and vendor-side privacy leads who need to demonstrate working command of the legal and operational side of protecting health information rather than only the security controls around it. The CHPC case studies are 5 cases and about 3,533 words.
1Harmonizing Privacy Governance After a Three-Hospital Merger
Regional Health - three hospitals, 61 clinics, 4,200 workforce members - completed a merger eighteen months ago and still runs three separate privacy programs. Hospital A's paper authorization form was last revised in 2016 and omits the expiration-date and revocation statements; Hospital B lets unit managers approve EHR access for their own staff; Hospital C's privacy officer reports to the CIO and has never briefed the board.
699 words, about 3 min2The Researcher, the Reporter, and the Employer's Broad Authorization
At a 480-bed teaching hospital, three requests land on the same Tuesday. (1) A cardiologist with an IRB-approved protocol for a rare arrhythmia asks the privacy office for a roster of 214 patients - name, MRN, date of birth, and ZIP code - so her coordinator can call them about enrollment; she says the IRB will approve the recruitment component next month.
679 words, about 3 min3The Access Request That Arrived in Three Parts
A 34-year-old patient submits a portal request for 'my complete record,' including counseling notes from 2019 when she saw a hospital-employed therapist, and asks that a copy be sent to a consumer health app she uses. Separately, she requests an amendment: she says the 'history of alcohol dependence' entry on her problem list is wrong and asks that it be deleted.
712 words, about 4 min4The Messaging App Nobody Vetted
A twelve-clinic orthopedic group wants clinicians to use a free consumer-grade messaging app to send wound photos, imaging, and patient names to one another and to outside physical therapists. The vendor offers only a click-through 'HIPAA compliance' addendum and notes in its FAQ that it stores messages on a third-party cloud and that messages older than 30 days sit in an offshore data center.
729 words, about 4 min5The Laptop, the Spreadsheet, and the Four-Factor Test
On Monday morning the privacy officer learns that a clinician's personal laptop was stolen from her car the previous Friday. The laptop was full-disk encrypted, but the clinician had exported a spreadsheet to the desktop for a quality-improvement project: 3,200 patients with name, date of birth, MRN, diagnosis code, insurance ID, and the last four digits of the SSN.
714 words, about 4 min