All Articles

CHPS Exam Mastery: The "3-6-6" Rule for Privacy Timelines

By Tom Granger
HIPAA
CHPS Exam Mastery: The "3-6-6" Rule for Privacy Timelines

To master the AHIMA CHPS (Certified in Healthcare Privacy and Security) exam, you need to differentiate between the Privacy Rule (patient rights/access) and the Procedural/Breach timelines.

The easiest way to remember these is by grouping them into "The 30s," "The 60s," and "The 6s."

1. The "30-Day" Rule: Access and Amendments

These dates focus on the patient’s direct interaction with their own records.

Action Timeframe Extension Allowed
Patient Access Request 30 Days 30 additional days (must provide reason)
Record Amendment 60 Days* 30 additional days
Response to Subpoena Varies Usually dictated by the court/state

  • Pro Tip: While HIPAA allows 60 days for amendments, many AHIMA resources and modern standards push for 30 days to align with access requests. Always look for "30" as the gold standard for standard patient access.

2. The "60-Day" Rule: Breach and Accounting

These dates focus on administrative transparency and "bad news."

Action Timeframe Extension Allowed
Breach Notification 60 Days None (must be "without unreasonable delay")
Accounting of Disclosures 60 Days 30 additional days

  • Breach Specifics: If a breach affects 500+ individuals, you must notify the OCR/HHS and prominent media outlets within 60 days. If it is under 500, you notify the individuals within 60 days but only notify the OCR annually (within 60 days of the end of the calendar year).

3. The "6-Year" Rule: Retention

In the world of HIPAA and CHPS, 6 is the magic number for documentation.

  • Accounting Period: Patients can request an accounting of disclosures going back 6 years.

  • Documentation Retention: HIPAA policies, signed authorizations, and breach notification records must be kept for 6 years from the date of creation or the date it was last in effect.

4. Easy Memory Guide: The "3-6-6" Method

Think of the timelines as a ladder of urgency:

30 Days (Direct Access): "I want my records now." (Fastest)

60 Days (Admin/Breach): "Something happened or I need a history report." (Middle)

6 Years (History): "Keep the paperwork just in case." (Longest)

Comparison Trick: Access vs. Accounting

  • Access is about the content of the record (30 days).

  • Accounting is about the history of who saw the record (60 days).

  • Mental Hook: It takes twice as long to figure out who looked at a file (60) than it does to just hand the file over (30).

All Articles Discuss your project