CHPC study plan

Differentiate required-by-law disclosures from permitted disclosures by sorting 25 self-written fact patterns into the correct category with no more than two misclassifications.

Apply the minimum necessary standard to 10 realistic requests for health information and write a one-sentence rationale for the scope of data released in each.

Enumerate the core elements and required statements of a valid authorization and identify the missing element in each of 8 deliberately flawed authorization samples.

Explain the permitted uses and disclosures that require an opportunity to agree or object, and state the circumstances under which that opportunity may be bypassed.

Map the scope, regulated parties, and core obligations of the HIPAA Privacy, Security, and Breach Notification Rules onto a single reference sheet.

Compare HIPAA against at least four other regimes (for example 42 CFR Part 2, state minor-consent and HIV statutes, the FTC Health Breach Notification Rule, and GDPR) across scope, consent model, individual rights, and enforcement.

Resolve 10 preemption questions by deciding whether HIPAA or a more stringent state or federal provision controls each fact pattern, and cite the reasoning.

Re-attempt every Domain 3 item missed in Week 1 and state the governing rule aloud before re-answering.

Apply the four-factor breach risk assessment to 8 incident scenarios and reach a breach versus not-a-breach determination with written justification for each factor.

Construct a notification timeline that specifies individual, HHS, and media obligations, including deadlines, triggers, and required content for each audience.

Classify 20 safeguards and controls as administrative, physical, or technical and identify which are missing from two sample control inventories.

Describe the roles, reporting lines, and decision authority of the privacy officer, security officer, and privacy oversight committee within a program governance structure.

Design a privacy auditing calendar specifying at least six audit types with frequency, sampling method, data source, and accountable owner.

Convert five regulatory requirements into audit test questions with defined pass criteria and evidence to be collected.

Outline the full sequence of a privacy investigation from intake and triage through fact-finding, determination, corrective action, and closure documentation.

Distinguish monitoring from auditing by classifying 10 program activities and justifying each classification in one line.

Compare the rights of access, amendment, restriction, accounting of disclosures, and confidential communications on scope, applicable timelines, and permissible grounds for denial.

Calculate the correct response deadline for 10 request scenarios, including cases requiring an extension and cases requiring a written denial.

Identify the permissible denial grounds and the individual's review rights in 6 contested-access scenarios.

Explain how fee limitations and the minimum necessary standard interact with an individual's request for a copy of their record.

Determine business associate status for 12 entity scenarios, including subcontractors, conduit and storage exceptions, and plan-sponsor arrangements.

Draft a checklist of required business associate agreement elements and flag the deficiencies in 8 sample agreements.

Design a role-based privacy training program that specifies curricula by role, delivery format, frequency, and completion tracking method.

Write a five-question knowledge check for each of three workforce roles and define the passing threshold and remediation path for failures.

Re-solve every item missed in Weeks 1 through 6 and write a one-sentence rule statement for each miss.

Work 40 mixed scenario questions drawn from the three heaviest domains under a 60-minute time limit.

Explain in writing how minimum necessary, authorization, and breach risk assessment interact across a single end-to-end disclosure scenario.

Build a one-page cross-domain map linking each permitted disclosure to its documentation requirement, safeguard obligation, and breach trigger.

Complete two full-length timed practice exams and score at or above 85% overall with at least 75% in every domain.

Remediate the three lowest-scoring domains with a focused 90-minute review and retest of each.

Reproduce from memory the key deadlines, notification content requirements, and core definitions on a self-made rapid-recall sheet.

Finalize exam-day logistics including scheduling, break plan, identification requirements, and a 48-hour pre-exam review checklist.