- C)HISSP at a Glance: Who Issues It and How the Exam Works
- The Numbers to Memorize
- Six-Domain Fact Sheet
- Domain 1: Healthcare Industry Fundamentals
- Domain 2: Regulatory Environment Essentials
- Domain 3: Privacy and Security Policies
- Domains 4 and 5: Governance, Risk Management and Risk Assessment
- Domain 6: Third-Party Risk Management
- Fees, Registration and Renewal Cheat Lines
- What Is Not Verified
- Sequencing Your Review Around the Six Domains
- Quick-Answer FAQ
- The C)HISSP here is Mile2's Certified Healthcare Information Systems Security Practitioner exam: 100 multiple-choice questions, about 2 hours, 70% to pass.
- Six domains run from the healthcare industry through regulation, policies, governance, risk assessment and third-party risk.
- The six course modules are curriculum, not a published weighted blueprint, so no domain should be skipped.
- Credential validity is three years, with 60 CEUs, a fee and an ethics acknowledgment on the central renewal route.
C)HISSP at a Glance: Who Issues It and How the Exam Works
This cheat sheet covers one credential only: the Certified Healthcare Information Systems Security Practitioner, issued by Mile2. Other certifications share a similar acronym, and mixing their facts into your preparation is a real risk. If you want the plain-language definition first, our explainer on what C)HISSP stands for and the overview What Is C)HISSP Certification? cover the naming in detail.
The format is straightforward. The exam is delivered online through the candidate's own Mile2 examination account, and standard Mile2 exams ordinarily do not require a scheduled live proctor, subject to the instructions that come with your purchase. You answer 100 multiple-choice questions in approximately 2 hours, and the passing criterion is 70%. Mile2 does not publicly disclose how many of the 100 questions are scored versus unscored, so treat every question as if it counts.
The Numbers to Memorize
Keep this table as your one-page reference. Every figure comes from Mile2's public pages as reviewed on September 29, 2026.
| Item | Verified Fact |
|---|---|
| Issuing body | Mile2 |
| Question count | 100 multiple-choice questions |
| Time allowed | Approximately 2 hours |
| Passing criterion | 70% |
| Scored/unscored split | Undisclosed |
| Public pass rate | Not publicly disclosed |
| Suggested experience | Twelve months of healthcare information-systems management experience (suggested, not a verified mandatory gate) |
| Course | Optional |
| Exam Combo price | USD 500 promotional / USD 795 list; includes preparation resources, simulator and two attempts |
| Credential validity | Three years |
| Renewal (central route) | 60 CEUs per three years, fee and ethics acknowledgment |
| Renewal fee per FAQ | USD 200 U.S., with reduced qualifying-region pricing; exam-based alternative available |
For deeper treatment of individual lines, see our guides to the C)HISSP passing score, the eligibility and prerequisites, and the full pricing breakdown.
Six-Domain Fact Sheet
The six content areas below mirror the detailed modules in Mile2's current linked course outline, which lists 25 numbered subtopics across the six modules. The front-page summary on Mile2's site uses shorter names for some modules, so you may see slightly different wording depending on where you look. The key point: these are course curriculum headings, not an official weighted or exhaustive exam blueprint. The outline PDF carries 2020 file metadata, and no 2026 syllabus revision is asserted here.
- Intro to the Healthcare Industry
- Regulatory Environment
- Healthcare Privacy & Security Policies
- Information Governance & Risk Management
- Information Governance & Risk Assessment
- Third-Party Risk Management
Domain 1: Healthcare Industry Fundamentals
This domain is the vocabulary foundation. Security decisions in healthcare only make sense if you understand who the players are and how information moves between them.
Intro to the Healthcare Industry
Know the landscape your security program protects, because later domains assume this context.
- The types of organizations that create, receive, store and transmit patient information: providers, payers, clearinghouses and their supporting vendors
- How clinical, administrative and financial information flows across those organizations
- Why healthcare data is a distinct security problem: availability affects patient care, and records are long-lived and sensitive
- The role of health information management and information systems in daily operations
Expect questions in this area to test recognition more than calculation. If you work in IT security outside healthcare, spend extra time here; if you come from a clinical or health information management background, this is likely your strongest domain and your technical security vocabulary elsewhere may need more attention.
Domain 2: Regulatory Environment Essentials
The Regulatory Environment domain is where a healthcare security practitioner earns the title. Rather than memorizing citations in isolation, learn what each rule requires of an organization and who is accountable.
Regulatory Environment
Be able to connect a regulatory requirement to the control or policy that satisfies it.
- The distinction between privacy obligations (who may use or disclose information) and security obligations (how information is protected)
- Covered entities versus the vendors and partners that handle information on their behalf
- Breach concepts: what counts as an incident, who must be notified, and why documentation matters
- Enforcement and accountability: how regulators evaluate whether an organization acted reasonably
- The relationship between federal requirements and additional state-level or sector-specific rules
Because the course outline is undated and the linked PDF has 2020 file metadata, confirm any detail about recent regulatory changes against current primary sources rather than assuming your study material is up to date. Our C)HISSP study guide walks through how to verify and organize this material.
Domain 3: Privacy and Security Policies
This domain translates regulation into the documents and controls an organization actually runs on. Scenario-style questions often live here: a situation is described, and you pick the policy response that best fits.
Healthcare Privacy & Security Policies
Know what a policy is for, who owns it and how it gets enforced.
- The difference between policies, standards, procedures and guidelines
- Access control principles in a clinical setting, including minimum necessary access and role-based approaches
- Workforce responsibilities: training, sanctions and acceptable use
- Patient-facing privacy practices, including how individuals' rights regarding their information are honored
- Policy lifecycle: creation, approval, communication, review and retirement
Key Takeaway
When a question describes a problem, ask which layer of the policy stack answers it. A gap in direction points to a policy, a gap in consistency points to a procedure, and a gap in behavior points to training or sanctions.
Domains 4 and 5: Governance, Risk Management and Risk Assessment
Mile2's outline splits information governance into two modules, one framed around risk management and one around risk assessment. Candidates frequently blur them, so keep the distinction clear: management is the ongoing program and decision-making structure, while assessment is the structured activity of identifying and measuring risk.
Information Governance & Risk Management
The program-level view: who decides, who is accountable and how risk is handled over time.
- Governance structures and the roles that carry security and privacy accountability
- Risk treatment options: mitigate, transfer, accept or avoid
- Aligning security investment with organizational priorities and patient-safety needs
- Incident response and contingency planning concepts, including keeping care available during disruption
Information Governance & Risk Assessment
The analytical view: finding and evaluating threats, vulnerabilities and impact.
- Asset identification, including systems and data that touch patient information
- Threat and vulnerability analysis and how likelihood and impact combine into a risk rating
- Documenting assessment findings and tracking remediation
- When assessments must be repeated, such as after significant system or environmental changes
A reliable exam habit: when an answer choice jumps straight to a control before the risk has been identified or rated, it is often premature. Assessment feeds management, and the order matters.
Domain 6: Third-Party Risk Management
Healthcare organizations depend heavily on outside vendors for billing, cloud hosting, transcription, imaging and analytics. This domain covers how to keep patient information protected once it leaves your direct control.
Third-Party Risk Management
Responsibility for patient information does not transfer with the data.
- Due diligence before engaging a vendor: security questionnaires, evidence review and risk tiering
- Contractual safeguards, including agreements that bind vendors to protect information and report incidents
- Ongoing oversight: periodic reassessment rather than a one-time check at onboarding
- Offboarding: data return or destruction and revocation of access
- Fourth-party exposure, where your vendor relies on its own subcontractors
Fees, Registration and Renewal Cheat Lines
Mile2 advertises an Exam Combo at USD 500 promotional or USD 795 list, which includes preparation resources, a simulator and two attempts. The bare-exam price and any member versus non-member tiers were not verified, so check the current product page before budgeting. The course itself is optional, which means self-directed candidates with relevant experience can pursue the exam without a mandatory training-hour total. For a deeper look at whether the spend pays off, see Is the C)HISSP Certification Worth It?
After you pass, the credential is valid for three years. The current central renewal route requires 60 CEUs per three years, a fee and an ethics acknowledgment. Mile2's FAQ lists a USD 200 U.S. renewal fee, with reduced pricing for qualifying regions, and an examination-based alternative is available. Be aware that older wording in the course outline conflicts with the current central renewal policy, so follow the central policy page rather than the outline on this point.
What Is Not Verified
A good cheat sheet is honest about its gaps. These items could not be confirmed from public official sources, so do not rely on anyone who states them as fact:
- The public pass rate and the scored versus unscored question split
- Whether the exam is open-book, whether a calculator is permitted and whether it is adaptive
- Any weighted domain blueprint or which domain is largest
- Any 2026 credential-specific salary premium
- A mandatory degree, reference requirement or training-hour total
For context on these open questions, our articles on the C)HISSP pass rate, salary and exam difficulty explain what can and cannot be said responsibly. Employers who value this credential tend to be healthcare delivery organizations, payers, health IT vendors and consultancies serving them; see C)HISSP jobs for role types.
Sequencing Your Review Around the Six Domains
Since no weights are published, a balanced sequence that builds from context to application makes sense. This is one possible order, not an official schedule.
Industry and regulation
- Domain 1 vocabulary and information flows
- Domain 2 requirements, accountability and breach concepts
Policies as the bridge
- Domain 3 policy hierarchy, access control and workforce responsibilities
- Map each regulatory requirement from Week 1 to the policy that implements it
Governance and risk
- Domains 4 and 5 together, contrasting management with assessment
- Practice ordering: identify, rate, treat, monitor
Vendors and full review
- Domain 6 due diligence, contracts and ongoing oversight
- Timed 100-question sets, reviewing every miss by domain
Domain 6 is placed last because it draws on everything before it: risk assessment, regulation and policy all converge in vendor oversight. Take timed sets on the C)HISSP Exam Prep practice test site to rehearse the roughly two-hour pacing, and check exam dates and scheduling to plan around your own account setup.
Quick-Answer FAQ
The exam has 100 multiple-choice questions over approximately 2 hours, and the passing criterion is 70%. Mile2 does not disclose how many questions are scored versus unscored.
The course is optional. Twelve months of healthcare information-systems management experience is suggested, but it is not a verified mandatory gate, and no mandatory degree, references or training-hour total has been verified.
Mile2 advertises the Exam Combo at USD 500 promotional or USD 795 list, including preparation resources, a simulator and two attempts. The bare-exam price was not verified, so confirm current pricing on the official product page.
No weighted exam blueprint is published. The six domains reflect Mile2's course modules, which are curriculum rather than an official weighted blueprint, so study all six rather than gambling on one.
It is valid for three years. The current central renewal route requires 60 CEUs, a fee and an ethics acknowledgment, with an examination-based alternative also available. Verify details on Mile2's renewal page, since older outline wording conflicts with current policy.