HCISPP study plan

Map the healthcare delivery ecosystem (providers, payers, clearinghouses, vendors) and explain how protected health information moves between them

Define the 18 HIPAA identifiers and distinguish between identifiers, de-identified data, and limited data sets

Compare covered entity, business associate, and subcontractor obligations and classify ten example organizations

Explain the difference between privacy, security, and confidentiality using healthcare scenarios

Draft the minimum necessary standard decision rules and apply them to three request scenarios

Write the authorization requirements checklist and identify when authorization is not required

Describe patient rights under privacy rules (access, amendment, accounting of disclosures) and the response timelines

Connect information governance principles (data stewardship, retention, classification) to clinical and administrative workflows

Explain how EHR, health information exchange, and telehealth architectures create exposure points for PHI

List the administrative, physical, and technical safeguard categories and give two concrete controls for each

Describe encryption, access control, and audit logging as they apply to clinical systems

Explain the breach notification decision path, including the four-factor risk assessment and notification deadlines

Summarize the scope and key obligations of HIPAA, HITECH, and the GDPR as they affect healthcare organizations

Compare the roles of HHS OCR, CMS, and state attorneys general in enforcement

Explain how state privacy and breach laws interact with federal requirements, including preemption

Describe the role of accreditation and certification frameworks (for example HITRUST and ISO 27001) in demonstrating compliance

Walk through the risk assessment process: asset identification, threat and vulnerability pairing, likelihood and impact scoring

Distinguish risk assessment from risk analysis and risk management, and explain risk tolerance and treatment options

Build a risk register entry for a sample scenario with likelihood, impact, and treatment recommendation

Select controls from a recognized framework to remediate the identified risks

Explain how business associate agreements establish and limit third-party obligations

Describe vendor due diligence steps including security questionnaires, SOC 2 review, and contractual security clauses

Identify third-party risk indicators such as subcontractor use, data location, and incident history

Design a vendor monitoring cadence and offboarding checklist

Apply the third-party risk lifecycle to a cloud EHR vendor scenario from selection through termination

Explain how incident response and breach notification responsibilities are allocated between covered entities and business associates

Describe supply chain and subcontractor risk and how to verify downstream controls

Connect third-party risk decisions back to organizational governance and reporting structures

Review all seven domains using a spaced-repetition schedule and flag weak areas

Complete timed practice sets and analyze misses by domain

Rehearse scenario-based questions that combine privacy, security, and third-party risk

Build a final one-page summary of key definitions, timelines, and frameworks