CHPS PRACTICE EXAM 1
WITH MULTIPLE CHOICE
PREP QUESTIONS AND
CORRECT ANSWERS
GRADED A+ 2025-2026
1. Which of the following is a goal of the minimum necessary requirement under the
HIPAA Privacy Rule?
a. Allow workforce members any and all access to protected health information in the
event that PHI needs to be accessed.
b. Identify and provide access to workforce members based on what PHI is needed for
their specific duties.
c. Ensure that all workforce members have the same access to PHI within an
organization.
d. Create a listing of all employees and what information they have access to with the
electronic systems. - ANS-b The HIPAA Privacy Rule established the rule of minimum
necessary with three specific goals: (1) identify the people in the workforce that need
access to PHI; (2) identify what information each person needs to carry out day-to-day
tasks of his or her job; and (3) limit the access to PHI based on need (45 CFR
164.514(d)(1); HHS 2003).
2. A patient is checking in at the registration desk and overhears a conversation
between another patient and the billing specialist regarding a specific diagnosis that is
not being covered under the patient's insurance. This is an example of which type of
disclosure?
a. Intentional
b. Unintentional
c. Incidental
,d. Authorized - ANS-c An incidental use or disclosure of protected health information
is an unavoidable use or disclosure due to the nature and practices of healthcare
organizations. As long as healthcare organizations are taking action and establishing
reasonable safeguards to prevent improper disclosures, incidental uses and
disclosures are allowable under the regulations. Reasonable safeguards can include
speaking quietly when discussing a patient's condition with family members, locking
cabinets and securing them in nonpublic locations, or applying the minimum
necessary when speaking about a patient in a public area such as the waiting room (45
CFR 164.502(a)(1); HHS 2013a).
3. Which of the following is the only scenario where breach notification can be delayed
past the 60-day notification requirement?
a. When law enforcement requests a delay due to open criminal investigation
b. When the organization's executive board requests the delay to prepare the statement
to media
c. When the internal investigation is not complete by the end of the 60 days
d. When a business associate needs more time to do the investigation into data
breached - ANS-a The only time breach notification may be delayed greater than 60
days past the day of discovery is when the request is made by law enforcement. If law
enforcement feels the notification of a data breach will impede or negatively impact an
open criminal investigation, they may request a delay in notification. The request for
delay by law enforcement can be a written request or an oral request. If the request is
written it should state the timeframe of the notification delay; however, if the request
is made orally, the delay in notification can by no longer than 30 days from the date of
the oral statement unless
4. During a recent change in a computer system's access, an organization determined
they were going to create role-based access based defined on the need for each job
type within an organization. This will limit the workforce to only have the functionality
in the system to complete assigned job duties.
This is an example of application of which of the following?
a. Disclosure management
b. Risk analysis
c. Audit controls
d. Minimum necessary - ANS-d The HIPAA Privacy Rule established the rule of
minimum necessary to (1) identify the people in the workforce that need access to PHI;
(2) identify what information each person needs to carry out the day-to-day tasks of
his or her job; and (3) limit the access to PHI based on need. When implementing
,5. An organization just finished updating the minimum necessary policy and
procedure. The new policy took effect on February 12, 2022. How long do they have to
maintain the previous version of the policy?
a. February 12, 2023
b. February 11, 2028
c. February 12, 2028
d. February 11, 2023 - ANS-b Under HIPAA's Security Rule, covered entities and
business associates must maintain documentation for a minimum of six years past the
date of its creation or the date when it last was in effect, whichever date is later. The
HIPAA Privacy Rule requires that documentation be retained for a minimum of six
years past the date of its creation or the date when it last was in effect, whichever date
is later. Since the document's last day of effectiveness was February 11, 2022, the
documentation must be retained until February 11, 2028, six years after the last date it
was effective (45 CFR 164.530(j)(2); HHS 2007c).
6. Which of the following is considered a patient's right under the HIPAA Privacy Rule?
a. Minimum necessary disclosure
b. Accounting of disclosure
c. Suspension of access to PHI
d. Removal of documentation from PHI - ANS-b The HIPAA Privacy Rule defines many
rights that a patient has for access to and protection of PHI. The right to an accounting
of disclosure allows for an individual to receive a report that defines disclosure of
protected health information for the past six years outside of the exclusions of 45 CFR
164.528(a)(1). Other patient's rights defined under HIPAA are the right to access a copy
of PHI, the right to request an amendment to PHI, the right to request restrictions to
PHI, the right to request confidential communication, the right to receive the notice of
privacy practices, and the right to file a complaint regarding a HIPAA violation (HHS
2022b).
7. How long does a covered entity have to respond to an accounting disclosure
request?
a. 60 days with no extension
b. 30 days with one 30-day extension
c. 30 days with no extension
, d. 60 days with one 30-day extension - ANS-d The accounting of disclosure response
times require that covered entities respond to the individual requesting no later than
60 days from the date of the request. If unable to provide within 60 days from the
request, the covered entity may extend the time to respond to a one-time 30-day
extension; however, the covered entity must provide written notification of the
extension to the requestor within the initial 60 days from the request, provide a reason
for the delay, and the date in which the accounting of disclosure will be provided (45
CFR 164.528(c)).
8. Mary requested an accounting of disclosures in January, March, and May of this year.
Each time Mary was provided with the accounting of disclosures information as
requested. Mary just requested an accounting of disclosures for the fourth time in six
months. Which of the following statements is true regarding the accounting of
disclosure?
a. The covered entity is allowed to charge a reasonable, cost-based fee for the second,
third, and fourth requests for accounting of disclosures and must inform the patient
prior.
b. The covered entity is not allowed to charge the patient for the accounting of
disclosures.
c. The covered entity may charge the patient a reasonable, cost-based fee for each of
the requests for accounting of disclosures without disclosing prior to the charge.
d. The covered entity is only allowed to charge for all of the accounting of disclosures
if they inform the patient prior to providing the acco - ANS-a A covered entity is not
allowed to charge for the first accounting of disclosures in a 12-month period;
however, if the patient requests subsequent accounting of disclosures in the same 12-
month period, the covered entity may charge a reasonable, cost-based fee for each of
the subsequent requests. The covered entity must inform the patient of the fee prior to
providing the accounting of disclosures and provide an opportunity to withdraw or
modify the request for a subsequent accounting to avoid or reduce the fee (45 CFR
164.528(c)(2)).
9. In the final HIPAA Omnibus Rule of 2013, which of the following was added to the
regulations regarding patient access?
a. A patient has a right to receive any and all medical records electronically, if
maintained electronically.
b. A patient has a right to receive his or her designated record set electronically, if
maintained electronically.
c. A patient has a right to receive a free copy of his or her designated record set yearly.
WITH MULTIPLE CHOICE
PREP QUESTIONS AND
CORRECT ANSWERS
GRADED A+ 2025-2026
1. Which of the following is a goal of the minimum necessary requirement under the
HIPAA Privacy Rule?
a. Allow workforce members any and all access to protected health information in the
event that PHI needs to be accessed.
b. Identify and provide access to workforce members based on what PHI is needed for
their specific duties.
c. Ensure that all workforce members have the same access to PHI within an
organization.
d. Create a listing of all employees and what information they have access to with the
electronic systems. - ANS-b The HIPAA Privacy Rule established the rule of minimum
necessary with three specific goals: (1) identify the people in the workforce that need
access to PHI; (2) identify what information each person needs to carry out day-to-day
tasks of his or her job; and (3) limit the access to PHI based on need (45 CFR
164.514(d)(1); HHS 2003).
2. A patient is checking in at the registration desk and overhears a conversation
between another patient and the billing specialist regarding a specific diagnosis that is
not being covered under the patient's insurance. This is an example of which type of
disclosure?
a. Intentional
b. Unintentional
c. Incidental
,d. Authorized - ANS-c An incidental use or disclosure of protected health information
is an unavoidable use or disclosure due to the nature and practices of healthcare
organizations. As long as healthcare organizations are taking action and establishing
reasonable safeguards to prevent improper disclosures, incidental uses and
disclosures are allowable under the regulations. Reasonable safeguards can include
speaking quietly when discussing a patient's condition with family members, locking
cabinets and securing them in nonpublic locations, or applying the minimum
necessary when speaking about a patient in a public area such as the waiting room (45
CFR 164.502(a)(1); HHS 2013a).
3. Which of the following is the only scenario where breach notification can be delayed
past the 60-day notification requirement?
a. When law enforcement requests a delay due to open criminal investigation
b. When the organization's executive board requests the delay to prepare the statement
to media
c. When the internal investigation is not complete by the end of the 60 days
d. When a business associate needs more time to do the investigation into data
breached - ANS-a The only time breach notification may be delayed greater than 60
days past the day of discovery is when the request is made by law enforcement. If law
enforcement feels the notification of a data breach will impede or negatively impact an
open criminal investigation, they may request a delay in notification. The request for
delay by law enforcement can be a written request or an oral request. If the request is
written it should state the timeframe of the notification delay; however, if the request
is made orally, the delay in notification can by no longer than 30 days from the date of
the oral statement unless
4. During a recent change in a computer system's access, an organization determined
they were going to create role-based access based defined on the need for each job
type within an organization. This will limit the workforce to only have the functionality
in the system to complete assigned job duties.
This is an example of application of which of the following?
a. Disclosure management
b. Risk analysis
c. Audit controls
d. Minimum necessary - ANS-d The HIPAA Privacy Rule established the rule of
minimum necessary to (1) identify the people in the workforce that need access to PHI;
(2) identify what information each person needs to carry out the day-to-day tasks of
his or her job; and (3) limit the access to PHI based on need. When implementing
,5. An organization just finished updating the minimum necessary policy and
procedure. The new policy took effect on February 12, 2022. How long do they have to
maintain the previous version of the policy?
a. February 12, 2023
b. February 11, 2028
c. February 12, 2028
d. February 11, 2023 - ANS-b Under HIPAA's Security Rule, covered entities and
business associates must maintain documentation for a minimum of six years past the
date of its creation or the date when it last was in effect, whichever date is later. The
HIPAA Privacy Rule requires that documentation be retained for a minimum of six
years past the date of its creation or the date when it last was in effect, whichever date
is later. Since the document's last day of effectiveness was February 11, 2022, the
documentation must be retained until February 11, 2028, six years after the last date it
was effective (45 CFR 164.530(j)(2); HHS 2007c).
6. Which of the following is considered a patient's right under the HIPAA Privacy Rule?
a. Minimum necessary disclosure
b. Accounting of disclosure
c. Suspension of access to PHI
d. Removal of documentation from PHI - ANS-b The HIPAA Privacy Rule defines many
rights that a patient has for access to and protection of PHI. The right to an accounting
of disclosure allows for an individual to receive a report that defines disclosure of
protected health information for the past six years outside of the exclusions of 45 CFR
164.528(a)(1). Other patient's rights defined under HIPAA are the right to access a copy
of PHI, the right to request an amendment to PHI, the right to request restrictions to
PHI, the right to request confidential communication, the right to receive the notice of
privacy practices, and the right to file a complaint regarding a HIPAA violation (HHS
2022b).
7. How long does a covered entity have to respond to an accounting disclosure
request?
a. 60 days with no extension
b. 30 days with one 30-day extension
c. 30 days with no extension
, d. 60 days with one 30-day extension - ANS-d The accounting of disclosure response
times require that covered entities respond to the individual requesting no later than
60 days from the date of the request. If unable to provide within 60 days from the
request, the covered entity may extend the time to respond to a one-time 30-day
extension; however, the covered entity must provide written notification of the
extension to the requestor within the initial 60 days from the request, provide a reason
for the delay, and the date in which the accounting of disclosure will be provided (45
CFR 164.528(c)).
8. Mary requested an accounting of disclosures in January, March, and May of this year.
Each time Mary was provided with the accounting of disclosures information as
requested. Mary just requested an accounting of disclosures for the fourth time in six
months. Which of the following statements is true regarding the accounting of
disclosure?
a. The covered entity is allowed to charge a reasonable, cost-based fee for the second,
third, and fourth requests for accounting of disclosures and must inform the patient
prior.
b. The covered entity is not allowed to charge the patient for the accounting of
disclosures.
c. The covered entity may charge the patient a reasonable, cost-based fee for each of
the requests for accounting of disclosures without disclosing prior to the charge.
d. The covered entity is only allowed to charge for all of the accounting of disclosures
if they inform the patient prior to providing the acco - ANS-a A covered entity is not
allowed to charge for the first accounting of disclosures in a 12-month period;
however, if the patient requests subsequent accounting of disclosures in the same 12-
month period, the covered entity may charge a reasonable, cost-based fee for each of
the subsequent requests. The covered entity must inform the patient of the fee prior to
providing the accounting of disclosures and provide an opportunity to withdraw or
modify the request for a subsequent accounting to avoid or reduce the fee (45 CFR
164.528(c)(2)).
9. In the final HIPAA Omnibus Rule of 2013, which of the following was added to the
regulations regarding patient access?
a. A patient has a right to receive any and all medical records electronically, if
maintained electronically.
b. A patient has a right to receive his or her designated record set electronically, if
maintained electronically.
c. A patient has a right to receive a free copy of his or her designated record set yearly.
