1.1.1 - CHPS Role Boundaries

• Many CHPS exam items are not pure law questions; they test whether you choose the right role-appropriate next step under uncertainty.
• Common wrong answers sound decisive but exceed scope: giving legal conclusions, disciplining staff directly, or treating every incident as an automatic breach.
• Role boundaries protect both compliance and credibility: good privacy/security practice means coordinating, verifying, mitigating, escalating, and documenting in the right sequence.
• If you know who owns the decision, you can eliminate many distractors before you even analyze the policy details.

flowchart TD
A[Privacy or security issue appears] --> B[CHPS identifies facts and risk]
B --> C[Within CHPS role: assess, coordinate, document]
C --> D[Need legal interpretation?]
D -->|Yes| E[Consult legal counsel]
D -->|No| F[Need technical root cause?]
F -->|Yes| G[Coordinate with security or IT]
F -->|No| H[Need workforce action?]
H -->|Yes| I[Coordinate with HR and management]
H -->|No| J[Proceed with policy-based next step]
J --> K[Mitigation, follow-up, reporting]

1.1.1.1 Key terms

• Role boundary: The limit of what the CHPS professional should decide or do directly.
• Operational decision: A policy-grounded action such as verify, contain, document, escalate, or educate.
• Defensible next step: The action that is supportable based on known facts, policy, and governing principles.
• Escalation: Routing an issue to the appropriate authority because of risk, uncertainty, or ownership.
• Mitigation: Reasonable efforts to reduce harm after an event or concern.
• Minimum necessary: Limit use, disclosure, or access to what is reasonably needed for the purpose.
• Incident: A privacy/security event requiring review; not automatically a breach.
• Breach analysis: A structured assessment to determine whether impermissible use/disclosure compromises protected information.
• Role-based access: Access granted according to job duties and need to know.
• Workforce accountability: Monitoring, investigation support, education, and sanctions coordination.
• Governance: Organizational oversight, accountability structures, policy ownership, and reporting pathways.
• Outside legal counsel role: Formal legal interpretation beyond the CHPS professional's authority.
• Technical root cause: Detailed system or engineering determination usually owned by IT/security specialists.

1.1.1.2 Must-know facts

• The CHPS role is usually advisory, coordinating, monitoring, and documenting rather than unilateral and punitive.
• If facts are incomplete, choose verification + mitigation + documentation + appropriate consultation, not a definitive unsupported conclusion.
• A strong exam distractor is an action that may be correct in principle but belongs to the wrong function.
• Do not assume every incident is a breach; analyze first.
• Do not disclose broadly for convenience; check minimum necessary.
• Do not bypass policy just because an operational shortcut seems efficient.
• Privacy/security professionals can recommend sanctions, but HR/management usually own employment action.
• Privacy/security professionals can coordinate technical investigation, but they do not need to perform low-level engineering tasks for CHPS purposes.
• Every operational action should leave a documentation trail: facts, analysis, mitigation, escalation, and follow-up.

1.1.1.3 Foundational role: what the CHPS professional owns vs supports

A Explanation

The first exam conflict is usually: Should the CHPS professional directly decide and act, or coordinate with the correct owner? The single resolving rule is this: own the privacy/security judgment and process, but do not assume authority that belongs to clinical staff, HR, legal counsel, executives, or technical engineers. In practice, CHPS owns intake, issue framing, risk-aware policy application, documentation, mitigation coordination, and escalation. CHPS often supports investigations, access reviews, sanctions consistency, and leadership reporting. CHPS does not diagnose patients, provide definitive outside-counsel legal opinions, configure systems as the main task, or impose employment actions without organizational authority.

WHY THIS IS TESTED: candidates often know the principle but miss the operational ownership. Exam writers reward the answer that stays inside the role while still moving the case forward. See Fig 1.

B Worked example

A hospital privacy officer receives a report that a nurse accessed a celebrity patient record. The nurse says she was only verifying the room number for a friend. The nurse has chronic attendance issues and was recently on a corrective action plan. A manager asks the privacy officer to "fire her today and notify the media because this is obviously a breach." Audit logs are not yet reviewed, and no disclosure outside the organization is confirmed.

Reasoning chain: Identify task: determine the most appropriate CHPS next step. Extract key facts: possible inappropriate access, incomplete facts, manager pressure, tempting clue of a celebrity patient, and distracting HR history. Apply rule: CHPS should coordinate access review, preserve evidence, involve management/HR per policy, assess mitigation, and document; CHPS should not independently terminate the employee or jump to public notification. Eliminate distractors: firing is owned by HR/management; media notification is premature and likely outside standard process; ignoring the event is unsafe. Verify: document the report, initiate audit review, limit further access if policy supports, and escalate according to incident procedures.

C Exam trap

D Checkpoint

Question: A privacy analyst learns that a registration clerk may have looked up a neighbor's account. The most appropriate next step is to:

1. A. Immediately conclude a reportable breach and notify affected parties.
2. B. Coordinate audit review, confirm facts, mitigate as needed, and document the case.
3. C. Suspend the clerk permanently without involving management or HR.
4. D. Ask IT to delete the audit logs after a screenshot is saved to avoid further exposure.

Answer: B.

• A: Tempting because inappropriate access can become a breach; wrong because incident review must come before a definitive notification conclusion.
• B: Tempting because it may seem less decisive; right because it stays within CHPS scope and preserves the defensible sequence.
• C: Tempting because intentional access may warrant sanction; wrong because unilateral permanent employment action is typically outside CHPS authority.
• D: Tempting because it sounds like containment; wrong because destroying logs undermines investigation and accountability.

1.1.1.4 Foundational boundaries: privacy/security judgment vs legal, HR, clinical, and technical authority

A Explanation

Board-style items often present an answer choice that is sensible in a vacuum but belongs to the wrong professional lane. The exam conflict is: Should you solve the problem yourself, or coordinate the proper owner while managing privacy/security risk? The resolving rule is to separate judgment about compliance process from specialized authority. CHPS may say, "This requires legal review," but should not act as outside legal counsel. CHPS may say, "This access pattern raises workforce accountability issues," but should not personally terminate staff. CHPS may say, "This security alert may affect confidentiality and availability," but should not be tested on writing the exact firewall rule. CHPS can help frame severity, gather facts, recommend safeguards, and ensure documentation.

This boundary matters most when the stem contains emotionally loaded facts: a famous patient, a phishing attack, a physician complaint, a vendor error, or leadership pressure. The most defensible answer is not the loudest action. It is the one that preserves process integrity while directing the issue to the right authority.

WHY THIS IS TESTED: the exam wants evidence that you can protect the organization without overclaiming authority. See Fig 2.

flowchart LR
A[CHPS professional] --> B[Privacy or security analysis]
A --> C[Policy application]
A --> D[Documentation and mitigation]
B --> E[Legal counsel: legal interpretation]
B --> F[HR and management: workforce action]
B --> G[Clinical leaders: patient care decisions]
B --> H[IT and security: technical root cause and fixes]
D --> I[Leadership reporting and governance]

B Worked example

A payer compliance analyst receives a complaint that member data may have been sent to the wrong vendor file path. The operations director says, "Just tell me whether we violated the law and whether the vendor contract is void." The security team has not yet confirmed file movement, and the vendor relationship manager notes the vendor still has an active business associate agreement. A distracting detail in the email chain mentions prior tension with the vendor over service levels.

Reasoning chain: Identify task: choose the best immediate response. Extract key facts: possible misrouting, incomplete technical confirmation, request for legal conclusion, existing vendor relationship, irrelevant contract frustration. Apply rule: CHPS should frame the event, coordinate fact verification with security/operations, review contractual reporting obligations with the appropriate stakeholders, and involve legal counsel for formal legal interpretation if needed. Eliminate distractors: declaring the contract void is beyond scope; ignoring the concern until the next committee meeting is too passive; directly reconfiguring vendor transfer pathways is technical ownership. Verify: document the intake, requested review, interim mitigation, and responsible parties.

C Exam trap

D Checkpoint

Question: A ransomware alert appears on a clinical documentation server. Which response best reflects CHPS role boundaries?

1. A. Personally rebuild the server and restore databases from backup.
2. B. Coordinate with security/IT, assess privacy and operational impact, document actions, and support escalation.
3. C. Determine which patients need immediate clinical treatment changes.
4. D. Issue a final legal opinion on notification obligations before technical review starts.

Answer: B.

• A: Tempting because technical remediation matters; wrong because deep system repair is not the core tested CHPS action.
• B: Tempting because it sounds indirect; right because CHPS should coordinate risk assessment, documentation, and escalation with technical owners.
• C: Tempting because downtime can affect care; wrong because treatment decisions belong to clinical leadership.
• D: Tempting because notification is a high-stakes issue; wrong because it jumps beyond scope and before fact development.

1.1.1.5 Applied judgment: choosing the safest next step when facts are incomplete

A Explanation

Many CHPS questions begin before the investigation is complete. The conflict is: act now or wait for certainty? The resolving rule is to take the safest supportable operational step now while avoiding unsupported final conclusions. This usually means verifying the request or report, preserving evidence, limiting further risk, consulting the right parties, and documenting what is known versus unknown. That is different from paralysis. It is also different from overreaction.

In foundational exam items, the best answer often contains verbs like verify, coordinate, mitigate, document, and escalate appropriately. Weak answers contain verbs like assume, declare, notify immediately, or share broadly without the needed analysis. The CHPS role is a disciplined decision function, not a guess-and-go function.

WHY THIS IS TESTED: real-world privacy/security work often starts with partial information. The exam rewards controlled action rather than certainty theater. See Fig 3.

flowchart TD
A[Report or request arrives] --> B[What is known now?]
B --> C[Immediate harm to limit?]
C -->|Yes| D[Mitigate and preserve evidence]
C -->|No| E[Verify facts and policy trigger]
D --> F[Document actions]
E --> F
F --> G[Escalate to owner if legal, HR, or IT needed]
G --> H[Reassess after facts develop]

B Worked example

A clinic receives a patient complaint that her ex-spouse "must have seen" her lab results because he referenced a medication change. She has diabetes and hypertension, and she mentions that a receptionist is related to the ex-spouse. A distracting detail is that she also recently shared some health information on social media. No audit review has occurred, and no portal compromise is confirmed. The medical director asks whether the organization should immediately admit wrongdoing.

Reasoning chain: Identify task: determine the most appropriate immediate CHPS response. Extract key facts: allegation of possible improper access or disclosure, relationship concern, incomplete technical and workforce facts, distracting public-social-media clue, leadership pressure for a conclusion. Apply rule: verify system access, evaluate account and disclosure pathways, limit any ongoing access concern, document the complaint, and coordinate with appropriate stakeholders. Eliminate distractors: admitting wrongdoing now is unsupported; dismissing the complaint because the patient posted online is irrelevant; giving the patient the full internal investigation file immediately is not the next step. Verify: create a case record and track mitigation and follow-up.

C Exam trap

D Checkpoint

Question: A complaint alleges unauthorized access, but the access logs have not yet been reviewed. The best initial CHPS response is to:

1. A. Close the complaint because there is no confirmed evidence yet.
2. B. Open a case, verify facts, assess interim mitigation, and document unresolved questions.
3. C. Publicly announce a breach to demonstrate transparency.
4. D. Ask the complaining individual to prove the violation before any internal review occurs.

Answer: B.

• A: Tempting because proof is not complete; wrong because allegation plus plausible access concern requires review.
• B: Tempting because it can feel procedural; right because it preserves a defensible, fact-based response.
• C: Tempting because transparency matters; wrong because notification before analysis is a classic distractor.
• D: Tempting because complainants may lack details; wrong because organizational review is still required when a plausible concern exists.

1.1.1.6 Integration: documentation, escalation, and accountability outputs

A Explanation

Even when CHPS does not own the final legal, clinical, technical, or HR decision, the role still produces critical outputs. The conflict is: once the issue is handed off, is the CHPS job done? The resolving rule is no. CHPS remains responsible for the privacy/security program side of the case: clear intake documentation, recorded rationale, appropriate escalation, mitigation tracking, follow-up status, and leadership-ready reporting where required. A strong CHPS answer does not stop at "refer to legal" or "notify IT." It also includes what should be recorded and what should be monitored next.

This is where many candidates miss easy points. They pick the correct escalation target but forget documentation, minimum necessary considerations, interim safeguards, or follow-up accountability. In operational practice, undocumented good judgment is hard to defend later. The exam reflects that reality.

WHY THIS IS TESTED: CHPS competence is measured not only by rule recognition, but by whether the organization can show a controlled, auditable response. See Fig 4.

B Worked example

A business associate reports that an employee emailed the wrong spreadsheet internally within the vendor organization. The file may contain member identifiers. The vendor has already disabled the employee's access. A distracting detail is that the employee resigned the same day, leading an executive to say, "Good, then the matter is closed." Legal review is pending, and the scope of data is not fully confirmed.

Reasoning chain: Identify task: determine the best CHPS follow-up. Extract key facts: vendor incident, initial containment, pending legal analysis, incomplete scope, distracting resignation detail. Apply rule: CHPS should document the report, verify contractual notice and cooperation steps, track data scope confirmation, record mitigation already taken, and maintain follow-up until closure criteria are met. Eliminate distractors: resignation does not end the case; stopping at verbal reassurance leaves an incomplete record; independently voiding the contract is beyond role. Verify: confirm next checkpoint, responsible parties, and documentation completeness.

C Exam trap

D Checkpoint

Question: After escalating a possible disclosure issue to legal and IT, which CHPS action remains most important?

1. A. Wait silently for others to decide because escalation ends CHPS involvement.
2. B. Track the case, document mitigation and owners, and ensure follow-up to closure.
3. C. Delete preliminary notes so only final conclusions remain in the file.
4. D. Share the full case broadly across the organization to increase awareness.

Answer: B.

• A: Tempting because specialists now have the issue; wrong because CHPS still owns program documentation and follow-up accountability.
• B: Tempting because it sounds administrative; right because auditable follow-up is core CHPS work.
• C: Tempting because clean records seem efficient; wrong because removing preliminary reasoning may undermine defensibility.
• D: Tempting because awareness matters; wrong because broad sharing may exceed minimum necessary.

1.1.1.7 Integration: rejecting classic CHPS boundary violations on exam day

A Explanation

The final foundational skill is fast elimination. The conflict is: which answer sounds strong but actually violates CHPS role boundaries? The single resolving rule is to reject options that are premature, overbroad, unsupported, or assigned to the wrong authority. Premature means notifying, concluding breach, or disciplining before analysis. Overbroad means sharing more information than needed or escalating to everyone reflexively. Unsupported means giving legal certainty without enough facts. Wrong authority means HR, legal, clinical, executive, or engineering actions framed as if CHPS personally owns them.

This matters because many options are plausible. The exam often uses close-call distractors where all four choices seem protective. The best choice protects the organization and respects scope, sequencing, and documentation discipline. See Fig 5.

WHY THIS IS TESTED: high-performing candidates eliminate wrong answers by ownership and sequencing before debating fine legal details.

flowchart TD
A[Answer choice] --> B{Too early?}
B -->|Yes| X[Reject]
B -->|No| C{Wrong owner?}
C -->|Yes| X
C -->|No| D{Too broad disclosure?}
D -->|Yes| X
D -->|No| E{Has documentation and follow-up?}
E -->|No| Y[Weak answer]
E -->|Yes| Z[Strong candidate]

B Worked example

A privacy manager is told that a physician emailed a patient list to a personal account to finish chart review at home. The physician also serves on a quality committee and claims the list was needed urgently for patient safety. A distracting detail is that the physician is highly respected and the department chair wants to "handle it quietly." The actual purpose of the email, encryption status, and whether the list was further shared are not yet known.

Reasoning chain: Identify task: select the best initial CHPS action. Extract key facts: potential impermissible transmission, unclear purpose and safeguards, leadership pressure, status-based distraction. Apply rule: verify facts, preserve evidence, assess minimum necessary and policy compliance, coordinate with security/management, document, and avoid unsupported conclusions. Eliminate distractors: "ignore because physician says patient safety" is too broad; "terminate access permanently now" exceeds role and timing; "notify all affected patients immediately" is premature. Verify: the safest next step is controlled investigation plus mitigation.

C Exam trap

D Checkpoint

Question: Which answer most likely reflects a boundary-violating distractor?

1. A. "Document the concern, verify the facts, and consult the appropriate owners."
2. B. "Assess whether minimum necessary and policy requirements were met before final conclusions."
3. C. "Issue an immediate final legal and disciplinary determination before the investigation begins."
4. D. "Coordinate mitigation while preserving records needed for review."

Answer: C.

• A: Tempting because it seems cautious; right because it reflects standard CHPS sequencing.
• B: Tempting because it sounds narrow; right because minimum necessary and policy alignment are core CHPS review steps.
• C: Tempting because decisive answers feel leadership-oriented; wrong because it is premature and exceeds normal role boundaries.
• D: Tempting because mitigation could seem secondary; right because risk reduction plus evidence preservation is appropriate.

Most common wrong answer and why: Immediate notification or final legal/disciplinary conclusion before analysis. It is tempting because it sounds decisive and protective. It is wrong because CHPS must first verify facts, coordinate mitigation, document the issue, and route domain-specific decisions to the proper owners.

If the stem says... think...

• "Legal has not yet reviewed" -> do not choose definitive legal conclusions.
• "Audit logs are pending" -> do not choose final breach or sanction outcomes yet.
• "Manager wants it handled quietly" -> documentation and proper escalation still matter.
• "IT is investigating root cause" -> your role is coordination, impact framing, and follow-up tracking.
• "HR is involved" -> choose accountability support, not unilateral personnel action.
• "Patient or member reported a concern without proof" -> plausible concerns still require structured review.

Mini decision rule: If an answer is too final, too technical, too punitive, or too broad for the facts given, reject it and choose the option that preserves process integrity.

• Role boundary -> own process and judgment, not every final organizational decision.
• Incomplete facts -> verify and mitigate before concluding breach or violation.
• Legal uncertainty -> consult counsel; do not pose as outside legal authority.
• Employment issue -> coordinate with HR/management; do not unilaterally sanction.
• Technical alert -> frame privacy/security impact; do not make engineering the tested endpoint.
• Complaint without proof -> plausible concern still triggers review.
• Escalation -> not abdication; CHPS still tracks the case.
• Documentation -> facts, rationale, mitigation, owners, follow-up.
• Minimum necessary -> broad internal sharing is still a risk.
• Strong answer choice -> verify, reduce risk, document, route.
• Weak answer choice -> declare, punish, notify, or over-disclose too early.
• Status-based noise -> celebrity, physician rank, executive pressure do not erase process.

1. A privacy analyst receives an allegation of inappropriate chart access, but no audit review has started. What is the most appropriate next step?

1. A. Declare a confirmed breach and begin notification.
2. B. Open a case, verify facts, assess mitigation needs, and document the concern.
3. C. Terminate the employee immediately.
4. D. Share the allegation with all department staff to gather informal feedback.

2. Which action is most likely outside the CHPS role boundary in a standard healthcare organization?

1. A. Coordinating with IT/security on a possible data exposure
2. B. Documenting the rationale for escalation and mitigation
3. C. Providing a final independent legal opinion as if serving as outside counsel
4. D. Recommending policy-based follow-up to leadership

3. A 300-bed hospital reports that a physician emailed a patient list to a personal account to finish work from home. The physician also serves on a patient safety committee, and the chief medical officer says the intent was good. Encryption status is unknown, and no further disclosure is confirmed. What is the most appropriate CHPS response?

1. A. Accept the physician's explanation and close the matter because patient safety was mentioned.
2. B. Verify facts, review policy and minimum necessary concerns, coordinate with security/management, and document next steps.
3. C. Revoke the physician's privileges permanently without committee input.
4. D. Send immediate notice to all patients on the list before the review begins.

4. A payer privacy professional receives a complaint that member information may have been routed to the wrong vendor folder. The security team has not yet confirmed file movement, and the operations vice president wants a same-day answer on whether the law was violated. The vendor has an active business associate agreement, and there is prior tension about service quality. What is the best next step?

1. A. Provide a final legal conclusion immediately so leadership can act.
2. B. Ignore the matter until the quarterly vendor meeting because the contract remains active.
3. C. Coordinate fact verification, review reporting obligations with the right stakeholders, document the case, and consult legal as needed.
4. D. Personally redesign the vendor transfer workflow and certify the technical fix.

5. A clinic patient alleges that an ex-spouse somehow learned about recent lab results. The patient has hypertension and diabetes, says a receptionist is a family friend of the ex-spouse, and mentions having discussed some health issues on social media. Audit logs are pending. What most requires immediate clarification by the CHPS professional?

1. A. Whether the patient's social-media post automatically waives organizational privacy obligations
2. B. Whether there is any evidence of workforce access, portal compromise, or disclosure pathway that warrants mitigation and review
3. C. Whether the medical director should publicly apologize immediately
4. D. Whether the receptionist should be fired before logs are checked

6. A hospital security alert suggests unusual downloads from a billing system. The privacy officer, CIO, HR director, and legal counsel are on a call. The CIO asks the privacy officer to confirm whether a reportable breach has definitely occurred; HR asks whether the employee should be terminated now. Logs are incomplete, but the account has already been disabled. What is the most appropriate CHPS position?

1. A. Confirm both the breach and the termination decision because disabling the account proves misconduct.
2. B. State that the issue is closed because access has been cut off and no further risk exists.
3. C. Frame the known facts, document containment, coordinate continued analysis, and defer final legal and employment determinations to the proper owners.
4. D. Take over the forensic technical investigation personally to avoid delay.

7. A business associate reports that a workforce member internally misrouted a spreadsheet containing possible member identifiers. The workforce member resigned that afternoon. Initial containment occurred, but data scope is still uncertain. An executive says, "Since the person is gone, there is nothing left for privacy to do." What is the best CHPS response?

1. A. Agree, because workforce departure ends the compliance risk.
2. B. Maintain case documentation, verify data scope, track contractual and investigative follow-up, and close only when the record is complete.
3. C. Order immediate public disclosure to demonstrate transparency.
4. D. Delete preliminary notes because they may later be confusing.

8. A department manager asks the privacy officer to "just handle" a suspected snooping case quietly because the employee is a high performer and the unit is short-staffed. Audit logs are not final, no external disclosure is known, and HR has not been notified. Which option is the most defensible CHPS next step?

1. A. Honor the manager's request and keep the review informal to protect operations.
2. B. Formally document the allegation, initiate appropriate review, preserve evidence, involve required stakeholders under policy, and avoid premature conclusions.
3. C. Announce a breach to all affected patients immediately to avoid delay criticism.
4. D. Suspend every employee on the unit until the source is identified.

1.1.1.8 1. Answer: B

A: Tempting because unauthorized access can become a reportable event; incorrect for this scenario because the stem says no audit review has started, so a final breach conclusion is premature. Single clue: "no audit review has started."

B: Tempting because it may feel less decisive than notifying; correct because it reflects the CHPS role: verify facts, assess mitigation, document, and begin a structured review. Single clue: the event is only an allegation at intake.

C: Tempting because wrongdoing may justify sanction; incorrect because unilateral termination is usually an HR/management action, not the immediate CHPS step. Single clue: the question asks for the next step before facts are confirmed.

D: Tempting because internal awareness may seem useful; incorrect because broad sharing may violate minimum necessary and create rumor-driven process failures. Single clue: the allegation is not yet confirmed.

1.1.1.9 2. Answer: C

A: Tempting because some candidates think IT-only issues exclude privacy staff; incorrect because CHPS appropriately coordinates with technical owners on risk and impact. Single clue: coordination is within scope.

B: Tempting because it sounds administrative rather than strategic; incorrect as a distractor because documentation of rationale is central to defensible CHPS practice. Single clue: documenting escalation is a core output.

C: Tempting because leadership often wants certainty and candidates want to sound authoritative; correct because acting as outside counsel exceeds the CHPS role boundary. Single clue: "final independent legal opinion."

D: Tempting because recommendations to leadership may feel executive; incorrect as a distractor because policy-based recommendations are within CHPS responsibilities. Single clue: recommending is different from independently imposing all decisions.

1.1.1.10 3. Answer: B

A: Tempting because a patient-safety explanation can sound protective and clinically justified; incorrect because the method of transmission and policy compliance remain unknown. Single clue: "Encryption status is unknown."

B: Tempting because it sounds procedural; correct because it addresses fact verification, policy review, minimum necessary, coordination, and documentation without overreaching. Single clue: key facts are incomplete, so process discipline matters most.

C: Tempting because email to a personal account may be serious; incorrect because permanent privilege action is not the immediate CHPS-owned step and requires appropriate authority. Single clue: no completed review yet.

D: Tempting because notification can seem risk-averse; incorrect because immediate notice before review is a classic premature-action distractor. Single clue: "no further disclosure is confirmed."

Authoritative support: HHS guidance and HIPAA compliance practice emphasize fact-based assessment, minimum necessary, and appropriate workforce/process controls rather than unsupported early conclusions.

1.1.1.11 4. Answer: C

A: Tempting because leadership demands an immediate answer and legal exposure feels urgent; incorrect because technical confirmation is pending, so a final legal conclusion is unsupported and outside the safest CHPS boundary. Single clue: "security team has not yet confirmed file movement."

B: Tempting because an active business associate agreement suggests a governed relationship; incorrect because active contracts do not eliminate the need for timely review and documented follow-up. Single clue: there is a current allegation needing verification.

C: Tempting because it may appear slower; correct because it matches CHPS responsibilities: verify facts, involve the right stakeholders, review obligations, document, and consult legal as needed. Single clue: incomplete facts plus governance implications.

D: Tempting because technical workflow may indeed need revision; incorrect because personally redesigning and certifying the fix is beyond the tested CHPS role. Single clue: this is technical ownership, not privacy/security oversight.

Authoritative support: HIPAA program operations and OCR-aligned compliance practice support structured investigation, documentation, and appropriate consultation rather than unsupported legal pronouncements.

1.1.1.12 5. Answer: B

A: Tempting because patient self-disclosure feels relevant; incorrect because a patient posting information does not remove the organization's duty to investigate possible internal access or disclosure. Single clue: the allegation concerns possible organizational access pathways.

B: Tempting because it requires more work than a quick explanation; correct because the immediate issue is whether any actual workforce or system pathway exists that requires mitigation and review. Single clue: audit logs are pending and access pathway is unknown.

C: Tempting because an apology may seem patient-centered; incorrect because apology before fact development may be premature and is not the most important immediate clarification. Single clue: the facts are still undeveloped.

D: Tempting because the receptionist relationship creates suspicion; incorrect because firing before review exceeds authority and skips fact confirmation. Single clue: "Audit logs are pending."

Authoritative support: OCR complaint-response expectations and sound privacy program practice prioritize investigation, mitigation, and documentation of plausible access concerns.

1.1.1.13 6. Answer: C

A: Tempting because account disabling suggests serious risk and possible misconduct; incorrect because disabling access does not itself establish a final breach determination or employment outcome. Single clue: "Logs are incomplete."

B: Tempting because containment has already occurred; incorrect because containment does not close the need for continued analysis, documentation, and appropriate final decisions. Single clue: the event analysis is still ongoing.

C: Tempting because it may seem less decisive than answering the CIO and HR directly; correct because it keeps CHPS inside scope while moving the case forward through analysis, documentation, and proper referral. Single clue: multiple owners are already present, and facts are incomplete.

D: Tempting because rapid technical investigation matters; incorrect because personally taking over forensic work is not the main CHPS role in this scenario. Single clue: the question asks for the CHPS position, not the engineer's task.

Authoritative support: HIPAA security oversight and incident-response governance emphasize coordinated response, role-based ownership, and documented analysis.

1.1.1.14 7. Answer: B

A: Tempting because the workforce member is no longer present and immediate recurrence risk is reduced; incorrect because compliance, contractual, and data-scope questions remain unresolved. Single clue: "data scope is still uncertain."

B: Tempting because it sounds administratively heavy; correct because CHPS must maintain documentation, confirm scope, and monitor follow-up to a defensible closure. Single clue: containment occurred, but closure criteria are not yet met.

C: Tempting because public disclosure may appear transparent; incorrect because it is still premature and may not be required based on facts not yet developed. Single clue: no final assessment exists.

D: Tempting because preliminary notes can be messy; incorrect because removing them may undermine the auditable case record and decision trail. Single clue: the investigation is still active.

Authoritative support: Privacy/security case management principles emphasize complete case records, mitigation tracking, and closure based on documented evidence, not workforce departure alone.

1.1.1.15 8. Answer: B

A: Tempting because staffing strain and local management pressure can make quiet handling sound practical; incorrect because informal handling risks weak documentation, inconsistent accountability, and policy deviation. Single clue: HR has not been notified and audit logs are not final.

B: Tempting because it is more formal than the manager wants; correct because it preserves evidence, follows policy, involves the right stakeholders, and avoids premature conclusions. Single clue: the case remains unconfirmed and requires proper review.

C: Tempting because fast notification can feel safest; incorrect because no external disclosure is known and the facts are not yet complete. Single clue: "no external disclosure is known."

D: Tempting because broad suspension appears aggressive and protective; incorrect because it is overbroad, punitive, and likely outside CHPS authority absent stronger facts. Single clue: the source is not identified and employment actions are not CHPS-owned.

Authoritative support: OCR-aligned privacy program expectations support appropriate investigation, documentation, and role-based workforce accountability rather than informal suppression or reflexive punitive action.