1|Page
HCCA CHPC EXAM
2025/26 LATEST VERSION
QUESTION
What is a Controlling Health Plan (CHP)?
Answer:
Health plan that controls its own business, actions, activities, and
policies; Controls the subhealth plan (SHP).
This applies to state Medicaid plans. For instance, the CHC is the state Medicaid,
and the SHP would be the local administrator.
Re: HCCA Privacy Compliance Handbook
QUESTION
Describe what to do with a "required" implementation specification
Answer:
Implement the specification as presented
QUESTION
Describe what to do with an "addressable" implementation specification
Answer:
Implement as presented, or if not reasonable and appropriate implement an
equivalent alternative measure.
QUESTION
Designated Record Set (DRS) - includes:
,2|Page
Answer:
Group of records maintained by or for a Covered Entity that comprises the following:
1. medical/billings records
2. enrollment/payment/claims adjudication/case management by health plan
3. other records used by or for covered entity to make decisions about individuals
QUESTION
Designated Record Set (DRS) - records excluded from DRS:
Answer:
Administrative data (audit trails, appointment schedules, that don't
imbed PHI). Incident reports.
Quality Assurance
Data.
Statistical reports.
QUESTION
DVD medical records are destroyed by
Answer:
Shredding and cutting
QUESTION
Few other examples for use or disclosure of PHI other that TPO:
Answer:
Public health interest, research, serious threat, organ/tissue donation decedent
information, worker's compensation insurers.
QUESTION
,3|Page
Give examples of administrative safeguards
Answer:
• Policies and procedures
, 4|Page
• Training and education
• Designation of individuals (Ex. Security Officer)
• Contingency Planning
QUESTION
Give examples of physical safeguards
Answer:
• Facility security or access plan
• Disposal processes and media reuse
• Data backup and storage
QUESTION
Give examples of technical safeguards
Answer:
• Passwords
• Encryption
• Auto Log Off
• Unique User Identification
QUESTION
HIPAA "consent" and "authorization" have key differences, what are they?
Answer:
Consent is voluntary for TPO, while authorization is required by the Privacy Rule for
use and disclosure of PHI
https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-
between-consent- and-authorization/index.html
HCCA CHPC EXAM
2025/26 LATEST VERSION
QUESTION
What is a Controlling Health Plan (CHP)?
Answer:
Health plan that controls its own business, actions, activities, and
policies; Controls the subhealth plan (SHP).
This applies to state Medicaid plans. For instance, the CHC is the state Medicaid,
and the SHP would be the local administrator.
Re: HCCA Privacy Compliance Handbook
QUESTION
Describe what to do with a "required" implementation specification
Answer:
Implement the specification as presented
QUESTION
Describe what to do with an "addressable" implementation specification
Answer:
Implement as presented, or if not reasonable and appropriate implement an
equivalent alternative measure.
QUESTION
Designated Record Set (DRS) - includes:
,2|Page
Answer:
Group of records maintained by or for a Covered Entity that comprises the following:
1. medical/billings records
2. enrollment/payment/claims adjudication/case management by health plan
3. other records used by or for covered entity to make decisions about individuals
QUESTION
Designated Record Set (DRS) - records excluded from DRS:
Answer:
Administrative data (audit trails, appointment schedules, that don't
imbed PHI). Incident reports.
Quality Assurance
Data.
Statistical reports.
QUESTION
DVD medical records are destroyed by
Answer:
Shredding and cutting
QUESTION
Few other examples for use or disclosure of PHI other that TPO:
Answer:
Public health interest, research, serious threat, organ/tissue donation decedent
information, worker's compensation insurers.
QUESTION
,3|Page
Give examples of administrative safeguards
Answer:
• Policies and procedures
, 4|Page
• Training and education
• Designation of individuals (Ex. Security Officer)
• Contingency Planning
QUESTION
Give examples of physical safeguards
Answer:
• Facility security or access plan
• Disposal processes and media reuse
• Data backup and storage
QUESTION
Give examples of technical safeguards
Answer:
• Passwords
• Encryption
• Auto Log Off
• Unique User Identification
QUESTION
HIPAA "consent" and "authorization" have key differences, what are they?
Answer:
Consent is voluntary for TPO, while authorization is required by the Privacy Rule for
use and disclosure of PHI
https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-
between-consent- and-authorization/index.html
