CHPA Recertification Requirements 2026: A Complete Guide

What Is CHPA Recertification and Why It Matters

The Certified Healthcare Protection Administrator (CHPA) credential signals that a healthcare security professional has demonstrated mastery across a rigorous, multi-domain body of knowledge - from physical security design to workplace violence prevention. But earning that credential is only the beginning. Recertification is the mechanism by which the certifying body confirms that holders are staying current in a field that evolves constantly alongside healthcare regulations, threat landscapes, and technology.

Unlike a one-time license, the CHPA is structured around a continuous professional development model. The credential does not simply expire on a calendar date; it lapses when a holder fails to demonstrate ongoing engagement with the domains that define healthcare security practice. That distinction matters enormously when planning your professional development calendar.

The credential is administered through the International Association for Healthcare Security and Safety (IAHSS), and recertification requirements are set by the IAHSS Certification Council. Candidates preparing for the initial exam or working through renewal should bookmark the CHPA Exam Prep practice test hub as a resource for staying sharp across all eight domains.

The Recertification Cycle Explained

CHPA recertification operates on a defined cycle tied to the date of your original certification. The cycle requires holders to accumulate a set number of continuing education units (CEUs) and submit documentation before their credential's expiration date. Missing that window - even by a short period - triggers lapse status rather than a grace extension.

Key Cycle Milestones

The recertification timeline has several critical checkpoints that credential holders should schedule proactively rather than reactively:

• Certification anniversary date: Your personal deadline - not a shared calendar date. Every CHPA holder has a unique expiration window based on when they originally passed the exam.
• Early submission window: Submitting before the expiration date allows time for the council to review documentation and request any corrections without creating a gap in your credential status.
• Audit notification period: A percentage of recertification submissions are selected for audit. Knowing this in advance shapes how you store and organize your supporting documents throughout the cycle.

CEU Categories and How to Earn Credit

Not all professional development activities count equally - or at all - toward CHPA recertification. The IAHSS Certification Council structures eligible credit into categories, and healthcare security professionals who plan their development intentionally will find plenty of pathways to meet requirements. Those who treat CEUs as an afterthought often scramble in the final months of their cycle.

Recognized Activity Types

The following activity types are generally recognized as eligible for CHPA CEU credit, though documentation requirements vary by category:

• Formal educational programs: Courses, seminars, and workshops delivered by recognized healthcare security, emergency management, or healthcare administration bodies. IAHSS-sponsored events carry strong credentialing alignment.
• Professional conferences: Attendance at healthcare security conferences where session content maps to one or more of the eight CHPA domains. Simply registering is not sufficient - session-level documentation is typically required.
• Published authorship: Peer-reviewed articles, book chapters, or formal white papers in the healthcare security field. Authorship carries more weight than co-authorship in most frameworks.
• Teaching and instruction: Delivering formal training to healthcare security staff - particularly in areas like Domain 7 (Healthcare Workplace Violence) or Domain 6 (Emergency Preparedness: Planning and Management) - may qualify for instructional credit.
• College coursework: Relevant credit-bearing courses in criminal justice, security management, healthcare administration, or emergency management may count toward the total.

Aligning Your CEUs to the Eight Exam Domains

This is where CHPA recertification becomes meaningfully different from generic security certification renewals. The eight domains are not arbitrary categories - they represent the actual scope of healthcare security practice as validated through IAHSS job task analyses. Your CEUs should reflect genuine engagement with these domains, and if selected for audit, reviewers will assess whether your documented activities are credibly connected to the domain knowledge base.

For Domain 8 specifically, which covers Investigation Management (5% of exam weight), the activities that generate CEUs are often embedded in broader security management programs rather than standalone courses. Reviewing the CHPA Domain 8: Investigation Management Complete Study Guide can help you identify specific competency areas where your professional development has gaps.

Documentation, Submission, and Audit Readiness

Regardless of how well you've planned your CEU activities, your recertification application is only as strong as your documentation. This is not an area where credential holders should improvise or reconstruct records at the end of a cycle.

What to Collect at the Time of Each Activity

1. Certificate of completion or attendance - must include your full name, the program or course title, the sponsoring organization, the date(s), and the number of contact hours or CEUs awarded.
2. Program agenda or course description - helps demonstrate domain relevance if reviewed by an auditor.
3. Proof of active participation - for multi-day conferences, consider keeping your name badge, session sign-in sheets, or post-event evaluation confirmation emails.

The Audit Process

If selected for audit, you will be asked to produce original documentation for your claimed CEUs. The audit is not designed to be punitive - it exists to ensure the credential maintains its integrity across all holders. Professionals who document in real time pass audits with minimal friction. Those who reconstruct documentation after the fact often discover gaps they cannot fill.

Renewal vs. Letting Your Credential Lapse

The stakes of failing to recertify are significant and worth spelling out clearly. A CHPA holder who misses the recertification window does not receive a warning letter and a grace period to complete a streamlined process. The credential lapses, and reinstatement requires sitting for and passing the full CHPA examination again - the same multi-domain, proctored exam that required significant preparation the first time.

Beyond the examination burden, a lapsed credential creates a visible gap in your professional profile. Healthcare security director positions, especially at larger health systems, are increasingly filled through formal search processes that involve credential verification. A lapsed CHPA during an active job search is a material disadvantage.

Proactive recertification is simply the less expensive and less stressful path - in time, money, and professional capital.

A Recertification Study Block for Credential Holders

Recertification is not just about accumulating contact hours - it is about genuine professional development. If you have identified domains where your daily role does not give you regular exposure, a structured review block can help you both fill CEU gaps and keep your knowledge sharp for any future CHPA examination retake requirement.

Mistakes That Delay or Derail Renewal

After reviewing what successful recertification looks like, it is worth cataloging the specific errors that create problems - because most of them are entirely preventable.

• Claiming CEUs for activities that are not documented: If you attended a training session but never received a certificate and cannot locate the agenda, that activity cannot be submitted. No documentation, no credit.
• Submitting activities with unclear domain relevance: A general management course, a generic customer service seminar, or a leadership retreat without clear security or healthcare content will face scrutiny. Add a brief notation explaining domain relevance at submission time.
• Waiting until the final month of the cycle: This compresses your timeline for gathering documentation, completing any remaining credit hours, and allowing the council time to process your application before your expiration date.
• Confusing contact hours with CEUs: Some providers report hours in different formats. Know the conversion your recertification application requires and apply it consistently across all activities.
• Failing to update contact information with the certification council: Renewal reminders and audit notifications are sent to the address on file. Professionals who change employers and do not update their records miss critical communications.

Frequently Asked Questions