CHPS study plan
CHPS · Give each week a clear focus.
8 weeks · About 6 hours per week
Privacy and Security Program Management and Administration & Privacy and Security Risk Management and Safeguards
Map every element of a privacy and security program (governance, roles, policies, training, monitoring) into an org chart and RACI
Draft a one-page program charter defining scope, authority, and reporting lines
Define confidentiality, integrity, and availability in healthcare context and give a clinical example of each
List the core components of a risk analysis and rank them by effort
Your checkpoint
A one-page program charter with a RACI matrix covering at least 8 program functions
Privacy and Security Program Management and Administration & Privacy and Security Risk Management and Safeguards
Write a policy outline covering access control, workforce training, and sanction policy
Perform a mock risk analysis on a small scenario and document threats, vulnerabilities, and likelihood/impact ratings
Select safeguards (administrative, physical, technical) that map to each identified risk
Explain how risk tolerance is set and who approves it
Your checkpoint
A completed risk register with 10 risks, ratings, and at least one mapped safeguard per risk
Privacy and Security Compliance and Regulatory Requirements & Privacy and Security Program Management and Administration
Summarize the major healthcare privacy and security regulatory frameworks and what each requires
Compare minimum necessary, need-to-know, and role-based access concepts with examples
Draft a workforce training plan tied to regulatory obligations
Identify documentation retention expectations for compliance evidence
Your checkpoint
A regulatory crosswalk table mapping 6+ obligations to the policy sections that satisfy them
Privacy and Security Compliance and Regulatory Requirements & Privacy and Security Risk Management and Safeguards
Distinguish patient rights (access, amendment, restriction, accounting) and the operational steps to fulfill each
Build a business associate/third-party oversight checklist covering contracts, due diligence, and monitoring
Trace how a regulatory requirement becomes a technical control and a monitoring report
Explain how audit logging supports both compliance and risk detection
Your checkpoint
A patient-rights fulfillment workflow plus a vendor oversight checklist, each with step owners
Privacy and Security Breach and Incident Management & Privacy and Security Risk Management and Safeguards
Define a security incident versus a reportable breach and list decision criteria
Draft a four-factor breach risk assessment worksheet
Sequence the incident response lifecycle from detection through post-incident review
Assign notification responsibilities and timelines to roles in a tabletop scenario
Your checkpoint
A completed breach risk assessment worksheet for a sample lost-device scenario with a documented conclusion
Privacy and Security Breach and Incident Management & Privacy and Security Compliance and Regulatory Requirements
Write an incident response runbook with escalation triggers and contact roles
Draft notification templates for affected individuals, regulators, and media as applicable
Outline containment, eradication, and recovery steps for a ransomware scenario
Describe how to document an incident log that satisfies regulatory evidence needs
Your checkpoint
An incident response runbook with escalation matrix and 3 notification templates
Privacy and Security Program Management and Administration & Privacy and Security Breach and Incident Management
Design a security awareness campaign with measurable completion and phishing-report metrics
Build a post-incident review template that captures root cause and corrective actions
Integrate lessons learned from incidents back into policy and training updates
Define program performance metrics and a quarterly reporting cadence
Your checkpoint
A program metrics dashboard spec with 6 KPIs, data sources, and reporting owners
Privacy and Security Program Management and Administration & Privacy and Security Compliance and Regulatory Requirements & Privacy and Security Risk Management and Safeguards & Privacy and Security Breach and Incident Management
Assemble all prior deliverables into an integrated program binder
Complete a timed 60-question practice set across all four domains and review every miss
Re-explain the three weakest concepts aloud without notes
Finalize a one-page exam-day checklist of decision rules and definitions
Your checkpoint
An integrated program binder plus a scored practice exam log with remediation notes for each missed item