AHIMA Certified in Healthcare Privacy and Security Examination Practice Test
Healthcare privacy and security work involves protecting individually identifiable health information while supporting appropriate access and use. CHPS practice topics include HIPAA breach-risk assessment, permitted data use and disclosure, de-identification, workforce responsibilities, security incident response, contingency planning, and the use of audit logs to investigate access to electronic health records.
Exam overview
About the AHIMA Certified in Healthcare Privacy and Security Examination Exam
Privacy and security professionals evaluate whether proposed uses or disclosures have an appropriate basis, whether the information shared is limited to the stated purpose, and whether agreements such as a data use agreement are needed for a limited data set. They assess the potential harm and scope of a suspected breach, document the reasoning, and coordinate follow-up. Security work also includes translating policies into usable procedures, assigning responsibilities for reporting concerns, and preserving evidence during an investigation. For electronic health records, relevant decisions include managing access, reviewing audit trails, and planning recovery when systems are unavailable. These scenarios call for applying HIPAA concepts to operational choices, distinguishing de-identified information from identifiable data, and connecting privacy safeguards with practical security controls.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A privacy incident may have affected several individuals. What is the purpose of conducting a documented breach-risk assessment under HIPAA?
Show answer
Correct answer: AA documented assessment helps determine whether an impermissible use or disclosure compromises the privacy or security of protected health information and whether notification obligations apply. The assessment considers relevant factors, such as the information involved, who received it, whether it was actually acquired or viewed, and mitigation.
An organization is evaluating a proposed secondary use of patient data for internal quality improvement. What is a sound first step?
Show answer
Correct answer: AA secondary use should be reviewed for its purpose, the information involved, applicable legal and policy requirements, and appropriate safeguards. Removing names alone may not prevent re-identification, so it should not be treated as automatic proof that data are anonymous.
A covered entity is considering using a limited data set for a project that is not otherwise permitted without an authorization. What agreement is generally required with the recipient?
Show answer
Correct answer: AHIPAA permits certain uses and disclosures of a limited data set for research, public health, or health care operations under specified conditions, including a data use agreement with the recipient. The agreement places limits on use and disclosure and requires safeguards.
An organization wants to use de-identified health information for an analytic project. Under HIPAA, which approach can establish that information is de-identified?
Show answer
Correct answer: BHIPAA recognizes two methods for de-identification: a qualified expert’s determination that the risk of identification is very small, or Safe Harbor, which requires removal of specified identifiers and no actual knowledge that the remaining information could identify an individual.
A health care organization wants to make security policies usable across departments. Which document feature most directly helps staff understand their operational responsibilities?
Show answer
Correct answer: APolicies establish expectations, while procedures describe how personnel carry them out. Clear, communicated procedures help make safeguards consistent and support accountability.
A privacy officer is reviewing whether a proposed disclosure is limited to the information needed for its stated purpose. Which principle is most directly relevant?
Show answer
Correct answer: AThe minimum necessary standard generally requires reasonable efforts to limit protected health information to the minimum needed to accomplish the intended purpose for many uses, disclosures, and requests. It has exceptions, including certain disclosures to or requests by a health care provider for treatment.
A healthcare organization is creating a contingency plan for loss of access to its electronic health record. Which activity best supports recovery after a disruption?
Show answer
Correct answer: AContingency planning includes procedures for data backup, recovery, and continued operations, as appropriate to the organization’s risk and requirements. Testing helps identify gaps before a real disruption and supports timely restoration of essential functions.
How to use this practice test
The free US Practice Tests session draws up to 20 random questions from the 50-question CHPS practice bank. Use each item to test decisions involving HIPAA privacy, disclosure limits, breach assessment, and security operations. Results appear after the session, helping identify concepts to revisit.
Preparation tips
- For breach scenarios, separate the incident facts from the documented risk-assessment factors and identify what evidence is needed to support follow-up.
- Compare de-identification with limited-data-set use; note the different safeguards and the role of a data use agreement.
- Practice evaluating proposed disclosures by stating the purpose, identifying the minimum information needed, and checking whether the use is permitted.
- Review how audit logs support access investigations, including what events to examine and how to preserve a clear record of findings.
- Map contingency activities to recovery needs, such as restoring access to electronic health records after a disruption.