CHPS

AHIMA frames it for people who already hold an HIM credential (RHIT or RHIA) or a coding credential and want to move into privacy and security work. It is a specialty credential, not an entry-level one, so prior certification and relevant professional experience are the realistic starting point. Confirm current eligibility requirements with AHIMA before applying.

Four domains: privacy and security program management and administration; compliance and regulatory requirements; risk management and safeguards; and breach and incident management. Expect questions that cross domains, such as how a regulatory requirement drives a safeguard decision or how an incident triggers notification obligations. Study each domain separately, then practice integrated scenarios.

It is a mid-to-senior specialty exam, so difficulty comes from applying rules to messy situations rather than memorizing definitions. Candidates with operational privacy or security experience tend to find it manageable; those without it struggle most on breach and risk questions. Build applied judgment through case practice rather than relying on rote review alone.

Those specifics are set by AHIMA and are not stated in the source material reviewed here, so treat any figure you hear secondhand with caution. Check AHIMA's official certification pages and candidate handbook for the current item count, time limit, and appointment rules before you schedule. Plan your pacing strategy only after confirming the current format.

The passing standard and retake policy are determined by AHIMA and are not published in the source material reviewed here, so do not rely on remembered figures. AHIMA's certification FAQ and candidate handbook are the authoritative sources for scoring, retake waiting periods, and fees. Review those before your exam date so a failed attempt does not catch you unprepared.

Start with compliance and regulatory requirements, since the other three domains depend on knowing the underlying rules. Move next to risk management and safeguards, then program management and administration, and finish with breach and incident management, which pulls from all three. Finish with mixed scenario practice so you learn to switch domains quickly under time pressure.

Three recur: memorizing rule text without practicing application, ignoring the program-management domain because it feels administrative, and mishandling breach questions by jumping to notification before completing the risk assessment. Another frequent problem is weak knowledge of safeguards across administrative, technical, and physical categories. Target these gaps deliberately in your final weeks.

Shift from reading to retrieval. Work timed scenario sets, then review every wrong answer until you can explain why the correct option is better, not just what it is. Re-audit your weakest domain, and rehearse breach decision steps in order. Keep one page of regulatory cross-references for quick review rather than rereading long source documents.

AHIMA credentials are maintained through recertification, which typically involves continuing education and a renewal cycle. The specific CEU hours, cycle length, and fees are set by AHIMA and are not stated in the source reviewed here. Check AHIMA's recertification pages for current requirements and track your CEUs as you earn them rather than at renewal time.