HealthCare Information Security and Privacy (HCISPP) Practitioner Practice Exam

The HealthCare Information Security and Privacy (HCISPP) certification validates a professional's knowledge and skills in protecting patient health information (PHI) within the healthcare industry. 

Who Should Pursue the HCISPP Certification?

• Security Analysts: Specializing in healthcare IT security and conducting security risk assessments.
• Compliance Officers: Ensuring adherence to HIPAA regulations and internal security policies.
• Privacy Officers: Overseeing patient data privacy practices and managing privacy risks.
• IT Security Managers: Leading and managing the overall information security program within a healthcare organization.
• Healthcare Professionals with Security Responsibilities: Physicians, nurses, and other healthcare personnel who handle ePHI and need to understand security best practices.

Prerequisites

(ISC)² recommends that candidates have:

• A minimum of two years of cumulative paid work experience in one or more knowledge areas of the HCISPP CBK (Common Body of Knowledge). This experience can involve information security, healthcare IT, compliance, or privacy within the healthcare industry.
• At least one year of experience within the healthcare industry demonstrates a familiarity with healthcare specific regulations and workflows.

Roles and Responsibilities 

• Healthcare System Administrators: Responsible for configuring and securing healthcare IT systems.
• Health Information Management (HIM) Professionals: Ensuring the integrity and confidentiality of patient medical records.
• Healthcare Application Developers: Building secure healthcare applications that comply with privacy regulations.

Exam Details 

• Exam Code HCISPP 
• Exam Duration 3 hours
• Exam Format Multiple Choice and Multi-Response Questions
• Number of Questions 125 Questions

 Course Outline

Domain 1: Healthcare Industry 

• Understanding the Healthcare Environment Components 
• Understanding Third-Party Relationships 
• Understanding Foundational Health Data Management Concepts

Domain 2: Information Governance in Healthcare 

• Understanding Information Governance Frameworks 
• Identifying Information Governance Roles and Responsibilities
• Aligning Information Security and Privacy Policies, Standards and Procedures
• Understanding and Comply with the Code of Conduct/Ethics in a Healthcare Information Environment 

Domain 3: Information Technologies in Healthcare

• Understanding the Impact of Healthcare Information Technologies on Privacy and Security 
• Understanding Data Life Cycle Management (e.g., create, store, use, share, archive, destroy) 
• Understanding Third-Party Connectivity 

Domain 4: Regulatory and Standards Environment

• Identifying Regulatory Requirements 
• Recognizing Regulations and Controls of Various Countries
• Understanding Compliance Frameworks 

Domain 5: Privacy and Security in Healthcare

• Understanding Security Objectives/Attributes 
• Understanding General Security Definitions and Concepts
• Understanding General Privacy Definitions and Concepts 
• Understanding the Relationship Between Privacy and Security
• Understanding Sensitive Data and Handling 

Domain 6: Risk Management and Risk Assessment 

• Understanding Enterprise Risk Management 
• Understanding Information Risk Management Framework (RMF) 
• Understanding the Risk Management Process
• Identifying Control Assessment Procedures Utilizing Organization Risk Frameworks 
• Participating in Risk Assessment Consistent with the Role in Organization
• Understanding Risk Response 
• Utilizing Controls to Remediate Risk 
• Participating in Continuous Monitoring

Domain 7: Third-Party Risk Management

• Understanding the Definition of Third-Parties in the Healthcare Context
• Maintaining a List of Third-Party Organizations 
• Applying Management Standards and Practices for Engaging Third-Parties 
• Determining When a Third-Party Assessment Is Required 
• Supporting Third-Party Assessments and Audits 
• Participating in Third-Party Remediation Efforts
• Responding to Notifications of Security/Privacy Events 
• Responding to Third-Party Requests Regarding Privacy/Security Events 
• Promoting Awareness of Third-Party Requirements