CHISP Certification Exam Prep 2026 Updated
Practice Questions, Comprehensive Health
Informatics Systems Review, Detailed Explanations,
Verified Answers, Complete Success Workbook
The CHISP credential validates expertise in health information technology (HIT),
including healthcare regulations, computer science, medical insurance billing, data
security, medical terminology, operational principles in healthcare, data mining,
and technology in quality of care.
The exam tests competencies across seven core areas: Clinical, Communications,
Compliance/Legal Considerations, Health Informatics, Information Analysis,
Medical Administrative Operations, and Technology.
DOMAIN 1: HEALTHCARE ENVIRONMENT & REGULATIONS (~15
Questions)
1. Which federal law established the framework for the adoption of Electronic
Health Records (EHRs) and strengthened privacy and security protections for
health information?
A) HIPAA (Health Insurance Portability and Accountability Act)
B) HITECH Act (Health Information Technology for Economic and Clinical
Health Act)
C) ACA (Affordable Care Act)
D) GINA (Genetic Information Nondiscrimination Act)
Answer: B) HITECH Act (Health Information Technology for Economic and
Clinical Health Act)
Rationale: The HITECH Act was enacted as part of the American Recovery and
Reinvestment Act of 2009. It promoted the adoption and meaningful use of EHRs
through incentive payments and strengthened HIPAA privacy and security
provisions, including breach notification requirements and direct liability for
business associates. HIPAA (A) established baseline privacy and security
,standards but did not promote EHR adoption. The ACA (C) focused on health
insurance reform, and GINA (D) protects genetic information privacy.
2. The HIPAA Privacy Rule applies to which of the following entities?
A) Only hospitals and physicians
B) Health plans, healthcare clearinghouses, and healthcare providers who
transmit health information electronically
C) All businesses that handle any health information
D) Only government-run healthcare facilities
Answer: B) Health plans, healthcare clearinghouses, and healthcare providers
who transmit health information electronically
Rationale: HIPAA applies to three types of covered entities: health plans,
healthcare clearinghouses, and healthcare providers who conduct certain healthcare
transactions electronically. Business associates are not covered entities but are
contractually bound to comply with HIPAA. The Privacy Rule does not apply to
all businesses that handle health information (C).
3. Under the HIPAA Privacy Rule, patients have the right to:
A) Access the PHI of any other patient
B) Access their own PHI, request amendments, and request an accounting of
disclosures
C) Demand that all their PHI be deleted
D) Require that their PHI be shared with all researchers
Answer: B) Access their own PHI, request amendments, and request an
accounting of disclosures
Rationale: Under HIPAA, patients have the right to access, inspect, and obtain a
copy of their protected health information (PHI), request amendments to their
records, and receive an accounting of certain disclosures. Patients do not have the
right to access other patients' records (A), demand deletion of all PHI (C), or
require sharing with all researchers (D).
,4. Which of the following is considered Protected Health Information (PHI)
under HIPAA?
A) Information that does not identify an individual
B) Individually identifiable health information transmitted or maintained in
any form or medium
C) Only electronic health records
D) Only paper-based medical records
Answer: B) Individually identifiable health information transmitted or
maintained in any form or medium
Rationale: PHI includes individually identifiable health information held or
transmitted by a covered entity or its business associate, in any form or medium—
electronic, paper, or oral. It is not limited to electronic records (C) or paper records
(D). De-identified information (A) is not PHI.
5. A "business associate" under HIPAA is defined as:
A) Any employee of a covered entity
B) A person or entity that performs functions or activities on behalf of a
covered entity that involve the use or disclosure of PHI
C) Any patient of a covered entity
D) Any government agency that regulates healthcare
Answer: B) A person or entity that performs functions or activities on behalf
of a covered entity that involve the use or disclosure of PHI
Rationale: A business associate is a person or entity that performs functions or
activities on behalf of a covered entity that involve the use or disclosure of PHI.
Covered entities must have written Business Associate Agreements (BAAs) with
their business associates. Employees of the covered entity (A) are not business
associates.
6. The HITECH Act Breach Notification Rule requires covered entities to
notify affected individuals of a breach of unsecured PHI:
A) Within 24 hours
B) Without unreasonable delay and no later than 60 calendar days after
discovery
, C) Within 30 days
D) Within 90 days
Answer: B) Without unreasonable delay and no later than 60 calendar days
after discovery
Rationale: The Breach Notification Rule requires covered entities to notify
affected individuals without unreasonable delay and no later than 60 calendar days
after discovery of the breach. Breaches affecting 500 or more individuals must also
be reported to the Secretary of HHS and prominent media outlets.
7. The Stark Law, also known as the Physician Self-Referral Law, prohibits:
A) All physician referrals
B) Physicians from referring patients to entities with which they have a
financial relationship for certain designated health services payable by
Medicare
C) All referrals to specialists
D) Patients from choosing their providers
Answer: B) Physicians from referring patients to entities with which they have
a financial relationship for certain designated health services payable by
Medicare
Rationale: The Stark Law prohibits physicians from referring Medicare patients
for certain designated health services to entities with which they have a financial
relationship, unless an exception applies. It is designed to prevent conflicts of
interest that could lead to overutilization.
8. The Anti-Kickback Statute prohibits:
A) All payments to healthcare providers
B) Knowingly offering, paying, soliciting, or receiving remuneration to induce
referrals for items or services payable by federal healthcare programs
C) All patient referrals
D) All healthcare marketing
Answer: B) Knowingly offering, paying, soliciting, or receiving remuneration
to induce referrals for items or services payable by federal healthcare
programs
Practice Questions, Comprehensive Health
Informatics Systems Review, Detailed Explanations,
Verified Answers, Complete Success Workbook
The CHISP credential validates expertise in health information technology (HIT),
including healthcare regulations, computer science, medical insurance billing, data
security, medical terminology, operational principles in healthcare, data mining,
and technology in quality of care.
The exam tests competencies across seven core areas: Clinical, Communications,
Compliance/Legal Considerations, Health Informatics, Information Analysis,
Medical Administrative Operations, and Technology.
DOMAIN 1: HEALTHCARE ENVIRONMENT & REGULATIONS (~15
Questions)
1. Which federal law established the framework for the adoption of Electronic
Health Records (EHRs) and strengthened privacy and security protections for
health information?
A) HIPAA (Health Insurance Portability and Accountability Act)
B) HITECH Act (Health Information Technology for Economic and Clinical
Health Act)
C) ACA (Affordable Care Act)
D) GINA (Genetic Information Nondiscrimination Act)
Answer: B) HITECH Act (Health Information Technology for Economic and
Clinical Health Act)
Rationale: The HITECH Act was enacted as part of the American Recovery and
Reinvestment Act of 2009. It promoted the adoption and meaningful use of EHRs
through incentive payments and strengthened HIPAA privacy and security
provisions, including breach notification requirements and direct liability for
business associates. HIPAA (A) established baseline privacy and security
,standards but did not promote EHR adoption. The ACA (C) focused on health
insurance reform, and GINA (D) protects genetic information privacy.
2. The HIPAA Privacy Rule applies to which of the following entities?
A) Only hospitals and physicians
B) Health plans, healthcare clearinghouses, and healthcare providers who
transmit health information electronically
C) All businesses that handle any health information
D) Only government-run healthcare facilities
Answer: B) Health plans, healthcare clearinghouses, and healthcare providers
who transmit health information electronically
Rationale: HIPAA applies to three types of covered entities: health plans,
healthcare clearinghouses, and healthcare providers who conduct certain healthcare
transactions electronically. Business associates are not covered entities but are
contractually bound to comply with HIPAA. The Privacy Rule does not apply to
all businesses that handle health information (C).
3. Under the HIPAA Privacy Rule, patients have the right to:
A) Access the PHI of any other patient
B) Access their own PHI, request amendments, and request an accounting of
disclosures
C) Demand that all their PHI be deleted
D) Require that their PHI be shared with all researchers
Answer: B) Access their own PHI, request amendments, and request an
accounting of disclosures
Rationale: Under HIPAA, patients have the right to access, inspect, and obtain a
copy of their protected health information (PHI), request amendments to their
records, and receive an accounting of certain disclosures. Patients do not have the
right to access other patients' records (A), demand deletion of all PHI (C), or
require sharing with all researchers (D).
,4. Which of the following is considered Protected Health Information (PHI)
under HIPAA?
A) Information that does not identify an individual
B) Individually identifiable health information transmitted or maintained in
any form or medium
C) Only electronic health records
D) Only paper-based medical records
Answer: B) Individually identifiable health information transmitted or
maintained in any form or medium
Rationale: PHI includes individually identifiable health information held or
transmitted by a covered entity or its business associate, in any form or medium—
electronic, paper, or oral. It is not limited to electronic records (C) or paper records
(D). De-identified information (A) is not PHI.
5. A "business associate" under HIPAA is defined as:
A) Any employee of a covered entity
B) A person or entity that performs functions or activities on behalf of a
covered entity that involve the use or disclosure of PHI
C) Any patient of a covered entity
D) Any government agency that regulates healthcare
Answer: B) A person or entity that performs functions or activities on behalf
of a covered entity that involve the use or disclosure of PHI
Rationale: A business associate is a person or entity that performs functions or
activities on behalf of a covered entity that involve the use or disclosure of PHI.
Covered entities must have written Business Associate Agreements (BAAs) with
their business associates. Employees of the covered entity (A) are not business
associates.
6. The HITECH Act Breach Notification Rule requires covered entities to
notify affected individuals of a breach of unsecured PHI:
A) Within 24 hours
B) Without unreasonable delay and no later than 60 calendar days after
discovery
, C) Within 30 days
D) Within 90 days
Answer: B) Without unreasonable delay and no later than 60 calendar days
after discovery
Rationale: The Breach Notification Rule requires covered entities to notify
affected individuals without unreasonable delay and no later than 60 calendar days
after discovery of the breach. Breaches affecting 500 or more individuals must also
be reported to the Secretary of HHS and prominent media outlets.
7. The Stark Law, also known as the Physician Self-Referral Law, prohibits:
A) All physician referrals
B) Physicians from referring patients to entities with which they have a
financial relationship for certain designated health services payable by
Medicare
C) All referrals to specialists
D) Patients from choosing their providers
Answer: B) Physicians from referring patients to entities with which they have
a financial relationship for certain designated health services payable by
Medicare
Rationale: The Stark Law prohibits physicians from referring Medicare patients
for certain designated health services to entities with which they have a financial
relationship, unless an exception applies. It is designed to prevent conflicts of
interest that could lead to overutilization.
8. The Anti-Kickback Statute prohibits:
A) All payments to healthcare providers
B) Knowingly offering, paying, soliciting, or receiving remuneration to induce
referrals for items or services payable by federal healthcare programs
C) All patient referrals
D) All healthcare marketing
Answer: B) Knowingly offering, paying, soliciting, or receiving remuneration
to induce referrals for items or services payable by federal healthcare
programs
