CHPC common mistakes
CHPC · Understand the traps and how to avoid them.
Applying a minimum-necessary analysis to every single disclosure, including disclosures to the patient, disclosures for treatment, and disclosures made under a valid authorization - and then picking an answer that imposes a minimum-necessary limit where none exists.
Candidates memorize 'minimum necessary' as a blanket rule and never build a mental list of the exceptions, so the phrase triggers a reflex answer.
What to do instead
Memorize the exclusion list as a set: disclosures to or requests by the individual, disclosures for treatment, disclosures pursuant to a valid authorization, disclosures to the Secretary for compliance, disclosures required by law, and uses/disclosures required for HIPAA compliance. Recite the list before answering any minimum-necessary item.
Choosing an answer that lets a covered entity require the patient to state a reason for the request, or that allows charging fees for searching, retrieving, or reviewing records when a patient asks for a copy of their own record.
Candidates import general 'reasonable cost-based fee' language without separating the narrow access fee (labor for copying, supplies, postage, preparation of a summary if agreed) from other permissible charges.
What to do instead
Drill the access rule as three fixed facts: no reason required, 30 days with one 30-day extension if notice is given, and fee limited to labor for copying plus supplies and postage. Reject any option that adds search, retrieval, or review charges.
Labeling a lost unencrypted laptop or a misdirected fax as a reportable breach purely because PHI was involved, or the reverse - assuming encryption always defeats notification without checking whether the data was actually rendered unusable.
Candidates reduce the analysis to 'PHI plus loss equals breach' and skip the presumption-of-breach framework and the safe harbor conditions.
What to do instead
Walk the sequence every time: was there an impermissible acquisition, access, use, or disclosure? If so, it is presumed a breach unless a documented four-factor risk assessment rebuts the presumption, or the PHI was encrypted/destroyed per the guidance. Then apply notification timing and thresholds.
Failing to require a business associate agreement because the vendor 'only stores the data,' 'only provides software,' or 'is just a conduit' - or, conversely, demanding a BAA from a pure conduit such as a postal service or an ISP transmitting data.
Candidates treat 'BAA required' and 'BAA not required' as vibes rather than a test: does the entity create, receive, maintain, or transmit PHI on behalf of the covered entity, and is it merely transmitting data incidentally?
What to do instead
Apply the two-question test in order: (1) Is the entity performing a function or service for the CE involving PHI? (2) Is it only a conduit with no persistent access? Cloud storage, EHR hosting, billing, and transcription all require a BAA; a courier delivering sealed records does not.
Selecting HIPAA as the controlling rule on an item where the stated state law is more stringent, on the assumption that federal law overrides state law.
Candidates conflate 'federal' with 'preemptive' and forget that HIPAA is a floor, not a ceiling.
What to do instead
Adopt the default answer 'the more protective rule controls' and require an explicit preemption exception before choosing HIPAA: public health reporting, HHS oversight, and a short statutory list. If the state rule gives the individual greater rights or restricts disclosure more, it wins.
Accepting an authorization that lacks a core element - no expiration date or event, no statement of the right to revoke, no description of the information to be used or disclosed - or using an authorization as the basis for a treatment disclosure.
Candidates remember that authorizations must be 'written and signed' and stop there, skipping the required-content checklist and the rule that treatment, payment, and operations do not need one.
What to do instead
Memorize the core elements as a checklist (description of PHI, who may disclose, who may receive, purpose, expiration, signature and date, statements about revocation and redisclosure, and the psychotherapy-notes carve-out). Separately memorize that treatment disclosures need no authorization.
Applying the wrong look-back period to a request for an accounting of disclosures, or including treatment, payment, and operations disclosures in the accounting.
Candidates blend the accounting rule with the access rule and forget that routine TPO disclosures, disclosures to the individual, and authorized disclosures are excluded.
What to do instead
Anchor two numbers: a six-year look-back (not the life of the record) and the exclusion list (TPO, individual, authorization, facility directories, national security). Any option that counts a TPO disclosure toward the accounting is wrong.
Starting the 60-day notification clock at the date the incident occurred, or at the date legal counsel was consulted, rather than at the date of discovery through reasonable diligence.
Candidates hear '60 days from the breach' and attach it to the wrong event, and they forget the 'known or should have known' standard that makes discovery earlier than actual awareness.
What to do instead
State the rule in a formula: clock starts on discovery (known or by reasonable diligence should have known) and runs no later than 60 calendar days, without unreasonable delay. Practice items where the discovery date differs from the incident date until the distinction is automatic.
Treating the annual privacy audit as the entire monitoring program, or closing a privacy investigation after interviewing the reporter but without documenting the intake, the evidence reviewed, the findings, the corrective action, and the closure.
Candidates confuse 'we do audits' with a monitoring plan and treat documentation as an administrative afterthought rather than the deliverable of the investigation.
What to do instead
Answer monitoring items by naming the components - proactive auditing, routine monitoring, dashboards and metrics, and a defined investigation workflow - and by insisting the file show intake, scope, evidence, finding, remediation, and follow-up verification.
Assuming a single annual privacy training module pushed to all staff satisfies the training obligation, with no role-specific content for high-risk staff and no completion records retained.
Candidates equate 'training happened' with 'training is effective and documented,' missing the elements examiners look for: content tailored to job role, frequency, and evidence of attendance.
What to do instead
Build the answer around three components: general training for all workforce, targeted training for roles with access to PHI (front desk, billing, research, IT), and documented completion with versioned content and a retention period. Mention refreshers and sanction policy linkage.