CHPS cheat sheet

Program governance triad: a designated privacy/security official (accountable owner), a governing committee (policy approval and prioritization), and documented policies/procedures (operational enforcement).

Policy hierarchy: law and regulation → organizational policy → standards → procedures → work instructions; lower tiers may not contradict higher tiers.

Workforce training cadence is a control requirement: initial training before access is granted, then recurring refresher training at a defined interval, with completion records retained.

Sanction policy must specify graduated consequences for workforce members who violate privacy or security policies, up to and including termination.

Minimum necessary standard: limit uses, disclosures, and requests for protected information to the least amount reasonably needed to accomplish the purpose.

Business associate/vendor management lifecycle: due diligence → written agreement with required clauses → periodic reassessment → termination and data return/destruction.

Documentation retention rule of thumb: retain compliance documentation (policies, training logs, risk analyses, agreements) for the period set by law, commonly six years from creation or last effective date.

Program reporting metrics: track training completion rate, access review completion, incident counts and closure time, and risk remediation status for committee oversight.

HIPAA Privacy Rule governs uses and disclosures of PHI; the Security Rule governs administrative, physical, and technical safeguards for ePHI only.

HIPAA identifiers: 18 specified identifiers (names, dates except year, geographic subdivisions smaller than state, SSNs, biometric identifiers, full-face photos, etc.) determine de-identification.

De-identification methods: expert determination (statistician certifies very small re-identification risk) or safe harbor (remove all 18 identifiers plus have no actual knowledge of re-identifiability).

Breach notification (HIPAA): notify affected individuals without unreasonable delay and no later than 60 days after discovery; HHS notice due at time of individual notice for 500+ residents of a state.

Authorization requirements: core elements plus required statements (right to revoke, right to refuse, redisclosure statement, expiration or event); compound authorizations allowed for research.

Patient rights under HIPAA: access (30 days, one 30-day extension), amendment, accounting of disclosures, restriction requests, confidential communications, and paper copy of notice.

GDPR principles: lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.

GDPR individual rights: access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making; response within one month, extendable by two.

Other frameworks to distinguish: FERPA (education records), COPPA (children under 13 online), GLBA (financial), PCI DSS (card data), state breach laws with varying notice deadlines.

Risk analysis vs. risk management: analysis identifies and assesses threats, vulnerabilities, likelihood, and impact; management selects and implements safeguards and monitors residual risk.

Risk level = likelihood × impact (qualitative matrix) or annualized loss expectancy = single loss expectancy × annualized rate of occurrence (quantitative).

Safeguard categories: administrative (policies, training, workforce clearance), physical (facility access, workstation use, device disposal), technical (access control, audit controls, encryption, integrity).

HIPAA Security Rule implementation specifications are either required or addressable; addressable means assess and document why the safeguard is or is not reasonable and appropriate, not optional.

Access control model: unique user identification, role-based least privilege, emergency access procedure, automatic logoff, and encryption/decryption of ePHI.

Encryption safe harbor: data rendered unusable, unreadable, or indecipherable to unauthorized persons (per HHS guidance) may fall outside breach notification requirements.

Contingency planning elements: data backup plan, disaster recovery plan, emergency mode operations plan, testing and revision procedures, and criticality analysis.

Risk treatment options: mitigate (apply controls), transfer (insurance, contract), avoid (stop the activity), or accept (documented with management sign-off).

Audit and monitoring controls: review information system activity for unauthorized access, log access to sensitive records, and conduct periodic access recertification.

Breach definition (HIPAA): acquisition, access, use, or disclosure of PHI not permitted by the Privacy Rule that compromises security or privacy; presumed a breach unless a risk assessment rebuts the presumption.

Four-factor breach risk assessment: nature and extent of PHI involved; the unauthorized recipient; whether PHI was actually acquired or viewed; and the extent of risk mitigation.

Three exceptions to the breach presumption: unintentional acquisition/access by a workforce member acting in good faith within scope; inadvertent disclosure between two authorized persons at the same covered entity; and a disclosure where the entity has a good-faith belief the recipient could not retain the information.

Discovery timing: a breach is treated as discovered on the first day it is known or by exercising reasonable diligence would have been known; the 60-day clock runs from discovery, not from investigation completion.

Notification tiers: individuals (no later than 60 days), HHS (contemporaneous for 500+ individuals; annual log for smaller breaches), and media (without unreasonable delay for 500+ residents of a state or jurisdiction).

Business associate duty: notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, per the agreement.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Incident documentation should capture date of discovery, date of occurrence, description, PHI involved, affected individuals, containment steps, risk assessment conclusion, and notifications made.

State breach laws may impose shorter deadlines and different triggers (e.g., 30 or 45 days), so the strictest applicable requirement governs multi-state incidents.