I85PREP
⌘ K
CHPS study materials
CHPS study resources

CHPS practice questions

One question at a time. Build your CHPS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy and Security Program Management and Administration

Which document is the primary governing instrument that establishes a healthcare organization's overall privacy and security program and assigns accountability for it?

  1. The IT department's network diagram
  2. The annual employee training roster
  3. The vendor business associate agreement template
  4. The organization's policy framework approved by leadership Correct answer.

Explanation

A program's governing policy framework, approved at the leadership level, establishes scope, authority, and accountability for privacy and security activities. Operational artifacts such as agreements, rosters, and diagrams support the program but do not govern it.

Question 2Privacy and Security Program Management and Administration

A privacy officer reports to the compliance committee, while the security officer reports to the chief information officer. What is the most significant program risk created by this structure?

  1. Excessive spending on privacy training
  2. Reduced independence of the security function from IT operations Correct answer.
  3. Duplicated audit logging across systems
  4. Slower procurement of encryption tools

Explanation

When the security officer reports through the IT chain, conflicting priorities can compromise the ability to enforce controls against operational convenience. Independence supports objective oversight and escalation.

Question 3Privacy and Security Program Management and Administration

Which committee structure best supports coordinated oversight of both privacy and security risks in a healthcare organization?

  1. An ad hoc working group convened only after a breach
  2. A privacy subcommittee reporting solely to the marketing department
  3. A security-only steering group chaired by the network administrator
  4. A joint privacy and security oversight committee with cross-functional membership Correct answer.

Explanation

Privacy and security risks intersect, so a joint oversight body with cross-functional representation supports coordinated decision-making and escalation. Single-discipline or reactive structures tend to leave gaps at the intersection.

Question 4Privacy and Security Program Management and Administration

An organization wants a documented statement of its intended privacy and security posture that leadership formally endorses. Which artifact best fits this need?

  1. A corrective action plan
  2. A system security plan appendix
  3. A risk register entry
  4. An approved information privacy and security policy Correct answer.

Explanation

An approved policy articulates management's intent and expectations and carries leadership endorsement. Risk register entries, corrective action plans, and system appendices are operational records that implement or track against policy.

Question 5Privacy and Security Program Management and Administration

A policy requires review every two years, but a new state law changes breach notification timelines. What is the most appropriate immediate action?

  1. Wait for the scheduled review cycle to update the policy
  2. Rely on staff to follow the stricter law without documentation
  3. Issue an interim policy update and document the regulatory driver Correct answer.
  4. Suspend the policy until the next review

Explanation

Policies must remain current with legal requirements; interim updates outside the review cycle are appropriate and should be documented and approved. Waiting or relying on informal practice creates compliance exposure.

Question 6Privacy and Security Program Management and Administration

Which element is essential for a policy to be considered effectively implemented rather than merely published?

  1. It is reviewed by the IT help desk
  2. It is stored on a shared drive
  3. It is approved, communicated, and monitored for adherence Correct answer.
  4. It is longer than comparable policies

Explanation

Effective implementation requires formal approval, communication to affected workforce members, and monitoring or enforcement. Publication alone does not demonstrate that the policy is followed.

Question 7Privacy and Security Program Management and Administration

Which activity is the foundational first step of a formal risk analysis?

  1. Purchasing cyber insurance
  2. Inventorying systems and data where protected information is created, received, or maintained Correct answer.
  3. Selecting security controls for each system
  4. Drafting the incident response plan

Explanation

Risk analysis begins with identifying the scope, including systems and data flows involving protected information. Control selection and other activities follow once assets and threats are understood.

Question 8Privacy and Security Program Management and Administration

During risk analysis, a team rates a threat as likely and its impact as severe. What does this rating primarily inform?

  1. The choice of encryption algorithm
  2. The system's backup schedule
  3. The prioritization of risk treatment Correct answer.
  4. The length of user passwords

Explanation

Likelihood and impact combine to characterize risk level, which drives prioritization of treatment. Technical configuration choices are made during control implementation, not from the rating itself.

Question 9Privacy and Security Program Management and Administration

Which set of risk treatment options is available to an organization managing identified information risk?

  1. Encrypt, delete, archive, and restore
  2. Detect, respond, recover, and report
  3. Plan, do, check, and act
  4. Mitigate, transfer, avoid, and accept Correct answer.

Explanation

Risk treatment generally involves mitigating (reducing), transferring (e.g., insurance or contract), avoiding (eliminating the activity), or accepting the risk. The other sets describe technical operations, incident phases, or a management cycle.

Question 10Privacy and Security Program Management and Administration

An organization decides to accept a residual risk rather than implement a costly control. What must accompany this decision to make it defensible?

  1. Notification to the media
  2. Documented rationale and approval by an accountable authority Correct answer.
  3. A verbal agreement among staff
  4. Immediate deletion of the risk register entry

Explanation

Risk acceptance should be documented with rationale and approved by someone with authority to accept it on the organization's behalf. Informal or undocumented acceptance undermines accountability.

Question 11Privacy and Security Program Management and Administration

Which metric best indicates whether a privacy and security program is reducing risk over time?

  1. Total pages of training material
  2. Number of policies published
  3. Trend in identified and remediated vulnerabilities Correct answer.
  4. Count of security staff meetings held

Explanation

A meaningful program metric reflects risk reduction, such as the trend of vulnerabilities identified and remediated within defined timeframes. Output counts like policies or meetings measure activity, not effectiveness.

Question 12Privacy and Security Program Management and Administration

Leadership asks for a dashboard showing program performance. Which combination best represents a balanced set of privacy and security measures?

  1. Only the count of audit findings from last year
  2. Only the number of reported incidents
  3. Compliance rate for access reviews, training completion, and time-to-remediate critical findings Correct answer.
  4. Only the IT budget spent on security

Explanation

A balanced dashboard combines preventive compliance measures, workforce readiness, and remediation timeliness. Single-dimension metrics can mislead by ignoring important aspects of program performance.

Question 13Privacy and Security Program Management and Administration

Which workforce members must receive privacy and security awareness training under a typical healthcare program?

  1. Only employees who have previously caused an incident
  2. Only the IT and compliance departments
  3. Only clinical staff who access patient records
  4. All workforce members, including contractors and volunteers with access Correct answer.

Explanation

Awareness training applies broadly to the workforce, including contractors and volunteers who may access protected information. Limiting training to select groups leaves gaps in awareness and accountability.

Question 14Privacy and Security Program Management and Administration

Which approach most improves the effectiveness of annual privacy and security awareness training?

  1. Delivering a single lengthy presentation once per year
  2. Combining role-relevant content with periodic reinforcement and phishing simulations Correct answer.
  3. Replacing training with a posted memo
  4. Requiring staff to sign an attendance sheet only

Explanation

Adults retain and apply knowledge better through role-relevant content reinforced periodically, including realistic simulations. One-time or passive approaches yield weaker, less durable awareness.

Question 15Privacy and Security Program Management and Administration

Which document defines the expectations a vendor must meet when handling an organization's protected information?

  1. A business associate or vendor agreement with security and privacy terms Correct answer.
  2. The organization's internal risk register
  3. The employee handbook
  4. The disaster recovery runbook

Explanation

Vendor agreements establish contractual obligations, including privacy and security requirements, for handling protected information. Internal documents like the handbook or risk register do not bind the vendor.

Question 16Privacy and Security Program Management and Administration

Before onboarding a new vendor that will process protected health information, which step should occur first?

  1. Add the vendor to the marketing contact list
  2. Sign the agreement and begin processing immediately
  3. Schedule the vendor for annual training
  4. Conduct a risk assessment of the vendor and its controls Correct answer.

Explanation

Assessing the vendor's controls and risk before engagement allows the organization to make informed decisions and set appropriate contractual terms. Onboarding before assessment removes the opportunity to mitigate identified risks.

Question 17Privacy and Security Program Management and Administration

What is the primary purpose of conducting periodic internal audits of the privacy and security program?

  1. To satisfy marketing claims about security
  2. To replace the need for risk analysis
  3. To verify that controls and practices operate as intended and identify gaps Correct answer.
  4. To assign blame for past incidents

Explanation

Internal audits provide independent verification that controls are designed and operating effectively and surface gaps for remediation. They are not tools for assigning blame or substitutes for other program activities.

Question 18Privacy and Security Program Management and Administration

An internal audit finds that access reviews are performed but not documented. What is the most appropriate program response?

  1. Document the finding, assign corrective action, and track to closure Correct answer.
  2. Discontinue access reviews
  3. Transfer the finding to the vendor
  4. Ignore the finding because reviews occur

Explanation

Findings should be formally documented, assigned corrective action with ownership, and tracked until verified as closed. Discontinuing or ignoring the practice worsens risk.

Question 19Privacy and Security Program Management and Administration

Which activity best demonstrates continuous monitoring of the security program between formal audits?

  1. Reviewing system logs and alerts on a defined schedule Correct answer.
  2. Publishing the security policy once
  3. Holding a kickoff meeting at project start
  4. Conducting a single annual penetration test

Explanation

Continuous monitoring relies on ongoing, scheduled review of logs, alerts, and control status to detect issues promptly. One-time tests, single publications, or kickoff meetings do not provide continuous visibility.

Question 20Privacy and Security Program Management and Administration

What is the primary role of an incident response plan within the privacy and security program?

  1. To document the organization's marketing strategy
  2. To define roles, steps, and communications for detecting and responding to incidents Correct answer.
  3. To guarantee that no incidents occur
  4. To replace the need for workforce training

Explanation

An incident response plan establishes the structure, responsibilities, and procedures for handling incidents. It cannot prevent all incidents and does not substitute for training or address unrelated business functions.

Question 21Privacy and Security Program Management and Administration

After a tabletop exercise reveals that staff were unsure who leads breach notification decisions, what is the most appropriate follow-up?

  1. Conclude the program is fully mature
  2. Cancel future exercises to save time
  3. Update the incident response plan to clarify roles and conduct a follow-up exercise Correct answer.
  4. Remove the notification requirement from policy

Explanation

Exercises are intended to expose gaps; the appropriate response is to correct the plan and verify improvement through further testing. Treating the gap as acceptable or eliminating requirements undermines readiness.

Question 22Privacy and Security Program Management and Administration

Which of the following best describes the relationship between an organization's privacy program and its security program?

  1. They are complementary, with privacy addressing use and disclosure and security addressing protection of information Correct answer.
  2. They are identical and can be managed by a single undifferentiated function
  3. Privacy applies only to paper records
  4. Security entirely subsumes privacy

Explanation

Privacy and security are complementary disciplines: privacy governs appropriate use and disclosure, while security protects confidentiality, integrity, and availability. They overlap but are not identical or fully subsuming.

Question 23Privacy and Security Program Management and Administration

An organization is expanding into a new state with different privacy requirements. What is the most appropriate program-level response?

  1. Apply the new requirements only to new patients
  2. Conduct a gap analysis against the new requirements and update policies and controls Correct answer.
  3. Wait until a complaint is filed before acting
  4. Assume existing policies satisfy the new jurisdiction

Explanation

Entering a new jurisdiction requires comparing current practices against applicable requirements and updating policies and controls accordingly. Assumptions or waiting for complaints create avoidable compliance risk.

Question 24Privacy and Security Program Management and Administration

Which approach best supports program sustainability when key privacy and security staff leave the organization?

  1. Maintain documented procedures, cross-training, and succession planning Correct answer.
  2. Eliminate written procedures to allow flexibility
  3. Centralize all knowledge with a single individual
  4. Rely on institutional memory held by departing staff

Explanation

Documented procedures, cross-training, and succession planning preserve institutional knowledge and continuity. Reliance on individuals or eliminating documentation creates fragility.

Question 25Privacy and Security Program Management and Administration

A program leader must justify budget for a new security control to executive leadership. Which framing is most persuasive and appropriate?

  1. Describing the control as a technical requirement only IT would understand
  2. Linking the control to specific risks, potential impacts, and expected risk reduction Correct answer.
  3. Promising the control will eliminate all incidents
  4. Comparing the control to a competitor's marketing materials

Explanation

Executives make decisions based on risk and impact, so tying the request to identified risks and expected risk reduction is most persuasive. Overpromising or relying on technical jargon weakens the case.

Question 26Privacy and Security Program Management and Administration

Which document typically serves as the foundation for an organization's privacy and security program by establishing high-level objectives and responsibilities?

  1. The incident response plan
  2. The vendor contract template
  3. The business associate agreement
  4. The organization's policy framework Correct answer.

Explanation

A policy framework sets the overarching principles, goals, and assignment of responsibilities that govern the entire privacy and security program. Other documents like contracts and incident plans are operational and flow from the policy framework.

Question 27Privacy and Security Program Management and Administration

Which role is typically responsible for the day-to-day administration of an organization's privacy program?

  1. The IT help desk manager
  2. The human resources director
  3. The privacy officer Correct answer.
  4. The chief financial officer

Explanation

The privacy officer is usually designated to oversee and administer the privacy program on a daily basis, including policy implementation, training, and compliance monitoring. Other roles have tangential or no direct responsibility for privacy program administration.

Question 28Privacy and Security Program Management and Administration

What is the primary purpose of a business associate agreement (BAA) in a healthcare organization?

  1. To define employee vacation policies
  2. To outline the marketing strategy for a new service
  3. To establish the fee schedule for IT services
  4. To ensure a vendor appropriately safeguards protected health information Correct answer.

Explanation

A BAA is a contract required under HIPAA that obligates a business associate to implement safeguards for protected health information and to comply with specified privacy and security provisions. It is not a general business contract for marketing, fees, or HR matters.

Question 29Privacy and Security Program Management and Administration

Which of the following is a common method for raising workforce awareness of privacy and security responsibilities?

  1. Conducting annual performance reviews
  2. Reviewing financial audit reports
  3. Distributing regular security reminders and newsletters Correct answer.
  4. Updating the organizational chart

Explanation

Regular communications such as reminders and newsletters keep privacy and security top-of-mind and reinforce training. Performance reviews, org charts, and financial audits do not directly educate the workforce on privacy and security.

Question 30Privacy and Security Program Management and Administration

What is the primary goal of an internal privacy and security audit?

  1. To satisfy individual employee performance goals
  2. To increase the organization's market share
  3. To verify that controls are implemented and functioning as intended Correct answer.
  4. To reduce the cost of cyber insurance premiums

Explanation

Internal audits are designed to provide assurance that policies, controls, and procedures are in place and operating effectively. They are not intended to drive market share, individual performance, or insurance costs directly.

Question 31Privacy and Security Program Management and Administration

Which of the following best describes the purpose of an incident response plan?

  1. To define the organization's marketing strategy
  2. To provide a structured approach for detecting, responding to, and recovering from security incidents Correct answer.
  3. To establish employee dress code policies
  4. To outline the annual budget for the IT department

Explanation

An incident response plan establishes roles, procedures, and communication protocols to manage security incidents effectively and minimize impact. Budgets, marketing, and dress codes are unrelated to incident response.

Question 32Privacy and Security Program Management and Administration

Which of the following is a key responsibility of a privacy and security program manager?

  1. Approving all marketing materials
  2. Managing the organization's payroll
  3. Coordinating program activities across departments Correct answer.
  4. Directly performing all security testing

Explanation

A program manager's role is to coordinate and integrate privacy and security efforts across the organization, ensuring alignment with business objectives. They typically delegate technical testing, marketing approvals, and payroll to appropriate specialists.

Question 33Privacy and Security Program Management and Administration

What is the purpose of a security awareness program?

  1. To develop new software applications
  2. To educate employees about potential security risks and their responsibilities Correct answer.
  3. To negotiate contracts with vendors
  4. To conduct background checks on job applicants

Explanation

A security awareness program informs employees about threats, safe practices, and their role in protecting information. Software development, contract negotiation, and background checks are separate functions.

Question 34Privacy and Security Program Management and Administration

Which of the following best describes the relationship between privacy and security programs?

  1. Privacy and security are identical and interchangeable terms
  2. Privacy is a subset of security that only applies to paper records
  3. Security is only concerned with physical locks, while privacy deals with digital data
  4. Privacy focuses on protecting individuals' data rights, while security focuses on protecting the confidentiality, integrity, and availability of information Correct answer.

Explanation

Privacy governs the collection, use, and disclosure of personal information according to individual rights and expectations, while security implements safeguards to protect information assets. They are complementary but distinct disciplines.

Question 35Privacy and Security Program Management and Administration

An organization wants to ensure that a new vendor handling sensitive data meets its privacy and security requirements. What is the most appropriate first step?

  1. Schedule a celebration for the new partnership
  2. Ask the vendor to provide a marketing brochure
  3. Immediately sign the contract to avoid delays
  4. Conduct a risk assessment of the vendor's practices Correct answer.

Explanation

Before engaging a vendor, the organization should assess the risks associated with the vendor's access to sensitive data, including reviewing their security and privacy controls. Signing a contract without due diligence, relying on marketing materials, or celebrating prematurely are not appropriate first steps.

Question 36Privacy and Security Program Management and Administration

A privacy officer discovers that a department is using an unapproved cloud storage service for patient records. What is the most appropriate immediate action?

  1. Instruct the department to cease use and migrate data to an approved service Correct answer.
  2. Wait for the next internal audit to address it
  3. Ignore the issue since it is a common practice
  4. Publicly announce the violation to the media

Explanation

The immediate priority is to stop the unauthorized use and ensure data is moved to a compliant environment, then assess and remediate any risk. Ignoring, publicizing, or delaying action could worsen the exposure and violate policy.

Question 37Privacy and Security Program Management and Administration

Which of the following is an example of a technical safeguard for protecting health information?

  1. Encryption of data at rest and in transit Correct answer.
  2. Posting a privacy notice in the lobby
  3. Conducting annual employee training
  4. Implementing a clean desk policy

Explanation

Technical safeguards use technology to protect information, such as encryption, access controls, and audit logs. Privacy notices, training, and clean desk policies are administrative or physical safeguards.

Question 38Privacy and Security Program Management and Administration

When developing a privacy and security program, which approach best ensures that controls are proportionate to the organization's risks?

  1. Implementing every available control regardless of cost
  2. Using only free and open-source tools
  3. Conducting a risk assessment and tailoring controls accordingly Correct answer.
  4. Copying the program from a larger organization

Explanation

A risk assessment identifies and prioritizes risks, allowing the organization to select controls that are cost-effective and appropriate for its specific context. Implementing all controls, copying another program, or limiting to free tools may not align with the organization's risk profile.

Question 39Privacy and Security Program Management and Administration

Which of the following best describes the purpose of a privacy impact assessment (PIA)?

  1. To determine the market demand for a new product
  2. To evaluate how a project or system affects the privacy of individuals and identify mitigation measures Correct answer.
  3. To calculate the financial return on investment of a new technology
  4. To assess employee satisfaction with the work environment

Explanation

A PIA is a structured process to identify and mitigate privacy risks associated with a project, system, or policy before implementation. It is not a financial, HR, or marketing analysis.

Question 40Privacy and Security Program Management and Administration

Which of the following is a key component of an effective access control program?

  1. Sharing passwords among team members
  2. Regular review of user access rights Correct answer.
  3. Disabling audit logging to improve performance
  4. Granting all employees administrative access

Explanation

Regular access reviews ensure that users have only the permissions necessary for their roles and that access is revoked when no longer needed. Sharing passwords, over-provisioning access, and disabling logs undermine security.

Question 41Privacy and Security Program Management and Administration

An organization is updating its incident response plan. Which element is most critical to include for effective breach notification?

  1. The marketing department's budget
  2. A list of employee birthdays
  3. The organization's social media strategy
  4. A predefined communication and escalation matrix Correct answer.

Explanation

A communication and escalation matrix specifies who must be notified, in what timeframe, and through which channels, which is essential for timely breach notification. Employee birthdays, social media strategy, and marketing budgets are irrelevant to breach notification.

Question 42Privacy and Security Program Management and Administration

What is the primary benefit of conducting tabletop exercises for privacy and security incidents?

  1. They provide a low-risk environment to test plans and identify gaps Correct answer.
  2. They replace the need for a written incident response plan
  3. They are required by all privacy laws
  4. They guarantee that no incidents will occur

Explanation

Tabletop exercises allow participants to walk through simulated scenarios, revealing weaknesses in plans, roles, and communication without the pressure of a real incident. They do not replace written plans, prevent incidents, or represent a universal legal requirement.

Question 43Privacy and Security Program Management and Administration

Which of the following is the most appropriate way to measure the effectiveness of a security awareness program?

  1. Tracking the rate of successful phishing simulations over time Correct answer.
  2. Counting the number of employees who attended a meeting
  3. Reviewing the number of pages in the security policy
  4. Measuring the length of the annual training video

Explanation

Phishing simulation success rates provide a behavioral metric that indicates whether employees are recognizing and responding appropriately to threats, reflecting the program's effectiveness. Attendance, video length, and policy page count are input measures that do not demonstrate behavior change.

Question 44Privacy and Security Program Management and Administration

Which of the following best describes the role of a data protection officer (DPO) under many privacy regulations?

  1. To develop the organization's products
  2. To independently oversee data protection strategy and compliance Correct answer.
  3. To manage the organization's sales team
  4. To handle all human resources complaints

Explanation

A DPO is responsible for monitoring compliance with data protection laws, advising on obligations, and acting as a contact point for regulators and individuals. Sales, product development, and HR complaints are outside the DPO's typical scope.

Question 45Privacy and Security Program Management and Administration

An organization is expanding its operations internationally and must comply with a new data protection law. What is the most appropriate first step for the privacy program?

  1. Immediately hire a large team of lawyers
  2. Conduct a gap analysis between current practices and the new law's requirements Correct answer.
  3. Copy the privacy policy from a competitor
  4. Ignore the law until enforcement occurs

Explanation

A gap analysis identifies discrepancies between existing practices and new legal requirements, enabling prioritized remediation. Hiring lawyers may be part of the response, but a gap analysis is the foundational step; ignoring the law or copying a competitor's policy is inappropriate.

Question 46Privacy and Security Program Management and Administration

Which of the following is a key consideration when selecting security controls for a healthcare organization?

  1. The controls should be the least expensive available
  2. The controls should be identical to those used by a similar organization
  3. The controls should be implemented without employee training
  4. The controls should be based on the organization's risk assessment and legal requirements Correct answer.

Explanation

Control selection should be driven by the organization's specific risks and applicable legal obligations to ensure they are effective and appropriate. Cost alone, copying others, or skipping training can lead to inadequate protection.

Question 47Privacy and Security Program Management and Administration

A privacy program manager is asked to justify the budget for a new security control. Which approach is most likely to gain executive support?

  1. Argue that the control is the most technically advanced available
  2. State that without the control, the organization will definitely be breached
  3. Compare the control to a competitor's marketing campaign
  4. Present a cost-benefit analysis that links the control to reduced risk and regulatory compliance Correct answer.

Explanation

Executives respond to business cases that quantify risk reduction, compliance benefits, and return on investment. Technical sophistication, fear-based claims, or irrelevant comparisons are less persuasive and may undermine credibility.

Question 48Privacy and Security Program Management and Administration

An organization discovers that a business associate has been storing protected health information in a non-compliant manner. What is the most appropriate action for the covered entity?

  1. Initiate the contract's remediation process and document the steps taken Correct answer.
  2. Report the business associate to the media
  3. Terminate the contract immediately without further communication
  4. Ignore the issue because the business associate is responsible

Explanation

The covered entity should follow the BAA's dispute resolution or remediation provisions, document corrective actions, and ensure the business associate comes into compliance. Immediate termination without communication may not be feasible or required, ignoring the issue leaves risk unaddressed, and media reporting is inappropriate.

Question 49Privacy and Security Program Management and Administration

Which of the following best illustrates the principle of least privilege in a privacy and security program?

  1. Allowing all managers unrestricted access to all records
  2. Granting employees access only to the information necessary for their job functions Correct answer.
  3. Using shared accounts to simplify access management
  4. Providing temporary access without a defined expiration

Explanation

Least privilege means users receive the minimum access required to perform their duties, reducing the risk of unauthorized access. Unrestricted access, indefinite temporary access, and shared accounts violate this principle.

Question 50Privacy and Security Program Management and Administration

An organization wants to integrate privacy and security into its system development life cycle (SDLC). Which approach is most effective?

  1. Assigning all privacy responsibilities to the marketing team
  2. Embedding privacy and security reviews at each phase of the SDLC Correct answer.
  3. Waiting for a data breach to identify weaknesses
  4. Conducting a single security test just before go-live

Explanation

Integrating privacy and security throughout the SDLC ensures that requirements are identified early, risks are mitigated during design, and controls are tested before deployment. A single pre-launch test, misassigning responsibilities, or waiting for a breach are reactive and less effective.