HCISPP study guide
HCISPP · Work through your exam, one topic at a time.
The HCISPP (HealthCare Information Security and Privacy Practitioner) is an ISC2 credential built around a single premise: protecting patient health information requires cybersecurity skill and privacy practice in the same person. ISC2 describes it as the only certification that combines cybersecurity skills with privacy best practices and techniques, and positions it as evidence that a holder can implement, manage and assess security and privacy controls in a healthcare organization using policies and procedures established by ISC2's cybersecurity experts. The HCISPP study guide has 7 sections and about 2,571 words.
01Healthcare Industry
Domain 1 tests the business and clinical context of healthcare: who touches PHI, how care and payment flow, and the vocabulary you need to reason about risk. The exam assumes you can look at a workflow and name the covered entity, the data, and the system.
364 words, about 2 min02Information Governance in Healthcare
Domain 2 tests how PHI is governed across its lifecycle - who decides, who provides day-to-day oversight, how long records are kept, and how disposal is proven. Governance sets decision rights, policy, and accountability; management executes.
336 words, about 2 min03Information Technologies in Healthcare
Domain 3 tests the systems and standards that carry clinical data, plus the availability and safety trade-offs that make healthcare IT different from general IT. HL7 v2 - pipe-delimited messages; ADT (registration), ORM (orders), ORU (results).
343 words, about 2 min04Regulatory and Standards Environment
Domain 4 tests the legal and standards landscape and, more importantly, how the pieces interact when more than one applies to the same data. HIPAA - Privacy, Security, Breach Notification, and Enforcement Rules, applied to covered entities and, via HITECH, business associates.
372 words, about 2 min05Privacy and Security in Healthcare
Domain 5 tests the substance of the Privacy and Security Rules: what you may do with PHI, what patients can demand, and which safeguards are mandatory. Treatment, payment, and health care operations (TPO) are permitted without authorization; most other uses need a valid authorization.
413 words, about 2 min06Risk Management and Risk Assessment
Domain 6 tests whether you can run a defensible risk process. The exam leans on NIST publications because HIPAA names them as the reference approach.
370 words, about 2 min07Third-Party Risk Management
Domain 7 tests how you select, contract with, and monitor organizations that touch PHI. Vendors and business associates sit behind a large share of reported healthcare breaches, so the exam expects operational answers, not just "get a BAA." A person or entity performing functions on behalf of a covered entity that involve PHI - claims processing, hosting, analytics, billing, legal, IT support - or providing a service where PHI access is incidental but possible.
373 words, about 2 min