CHPS study guide
CHPS · Work through your exam, one topic at a time.
The Certified in Healthcare Privacy and Security (CHPS®) credential is one of the certifications offered by the American Health Information Management Association (AHIMA). AHIMA positions the CHPS credential alongside its Clinical Documentation Integrity (CDIP®) and Data Analytics (CHDA®) credentials, describing these as paths for professionals who already hold an HIM credential such as the RHIT or RHIA, or a coding credential, and who are ready to move into emerging areas of health information work involving information security, document integrity, and big data. The CHPS study guide has 4 sections and about 1,403 words.
01Privacy and Security Program Management and Administration
Program management questions ask whether you can build and run a privacy and security program as a system : governance and accountability, written policies and procedures, workforce training, role design (a privacy officer, a security officer, and how they coordinate), vendor/third-party oversight, and continuous monitoring and auditing. Know the difference between a policy (a high-level statement of intent and authority), a standard (mandatory requirements that operationalize policy), a procedure (step-by-step instructions), and a guideline (recommended, non-mandatory).
350 words, about 2 min02Privacy and Security Compliance and Regulatory Requirements
This domain covers the legal and regulatory landscape and how an organization maps its obligations to controls. You should understand the categories of law-comprehensive privacy statutes, sector-specific rules (health, financial, education), breach-notification laws, and security frameworks-and the core privacy principles that recur across them: notice, choice/consent, purpose limitation, data minimization, access and correction, retention limits, and accountability.
365 words, about 2 min03Privacy and Security Risk Management and Safeguards
Risk management questions ask you to identify threats and vulnerabilities, estimate likelihood and impact, select safeguards, and treat residual risk. Know the difference between a threat (a source of harm), a vulnerability (a weakness a threat can exploit), and risk (the combination of likelihood and impact).
335 words, about 2 min04Privacy and Security Breach and Incident Management
Incident management asks whether you can prepare for, detect, contain, assess, notify, and learn from a breach. Distinguish an event (an observable occurrence), an incident (an event that threatens confidentiality, integrity, or availability), and a breach (an incident that triggers legal notification duties).
353 words, about 2 min