The PHR exam tests judgment, not just memorization. Nowhere is this clearer than in questions on data and safety, where the most common failure is confusing a privacy violation with a security flaw.
Topics covering HR Information Management, Safety, and Security are woven throughout the five PHR functional areas. They test your ability to manage HR data securely, ensure regulatory compliance (OSHA, HIPAA, GINA), and apply workplace safety protocols, emphasizing judgment in scenarios over rote memorization.
Key facts
- Exam Structure
- These topics are integrated within the 5 main PHR sections: Business Management, Talent Planning & Acquisition, Learning & Development, Total Rewards, and Employee & Labor Relations.
- Official Body
- HRCI (Human Resources Certification Institute) administers the PHR exam.
- Pass Rate
- The PHR exam pass rate is approximately 65%, according to HRCI's published data.
- Study Hours
- Candidates typically report needing 80-120 hours of focused study to pass.
- Exam Format
- Computer-based, scenario-focused multiple-choice questions.
- Salary Potential
- A PHR certification often correlates with salaries in the $70,000 to $120,000 range.
What Key Formulas and Rules Must I Memorize?
Mastering these topics requires knowing specific numbers and frameworks cold. The exam will give you a scenario and expect you to apply the correct rule or formula without hesitation.
Core Safety Formulas
You are expected to calculate and interpret basic OSHA safety metrics. These are not just abstract formulas; they are tools for analysis.
Studying for PHR? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
IR = (Number of OSHA Recordable Injuries & Illnesses × 200,000) ÷ Total Employee Hours Worked
The 200,000 constant represents the hours worked by 100 full-time employees in a year (100 employees × 40 hours/week × 50 weeks/year). This standardizes the rate for comparison.
IR = (5 × 200,000) ÷ 300,000
IR = 1,000,000 ÷ 300,000 = 3.33
Interpretation: The company's incident rate is 3.33. For every 100 full-time employees, there were 3.33 recordable incidents. This number is then compared to industry averages from the Bureau of Labor Statistics (BLS).DART Rate = (Number of cases with Days Away, Restriction, or Transfer × 200,000) ÷ Total Employee Hours Worked
This is a subset of the IR and measures the rate of more severe incidents that result in lost work time, restricted duties, or job transfer.
Thresholds and Rules to Memorize
These are high-frequency topics. Knowing them saves critical time and prevents simple mistakes.
OSHA Recordkeeping & Reporting
- Reporting Deadline (Severe Incidents): Report any work-related fatality to OSHA within 8 hours. Report any work-related in-patient hospitalization, amputation, or loss of an eye within 24 hours.
- Record Retention: The OSHA 300 Log, 300A Summary, and 301 Incident Report forms must be maintained for 5 years following the year to which they relate.
- Small Employer Exemption: Employers with 10 or fewer employees throughout the previous calendar year are generally exempt from routine OSHA recordkeeping.
Key Data Retention Periods
- Form I-9: Retain for 3 years after the date of hire or 1 year after employment termination, whichever date is later. This is a classic "choose the longer period" exam question.
- FLSA Records: Payroll records must be kept for at least 3 years. Records used for wage computations (like time cards) must be kept for 2 years.
- FMLA Records: Must be retained for 3 years.
- COBRA Records: Notices and other records must be kept for 6 years.
- IRS Payroll Tax Records: Must be kept for at least 4 years after the tax is due or paid, whichever is later.
Privacy and Information Security
- HIPAA (Health Insurance Portability and Accountability Act): Governs Protected Health Information (PHI). HR encounters this through benefits administration. Key concepts are the "minimum necessary" rule and patient rights.
- GINA (Genetic Information Nondiscrimination Act): Prohibits discrimination based on genetic information and strictly limits the acquisition and disclosure of such information. This is a frequent companion to HIPAA on exam questions.
- GDPR (General Data Protection Regulation): The PHR exam is U.S.-centric. While you should be aware of global privacy principles like GDPR, you will not be tested on its specific articles. The focus remains on U.S. federal law.
Calculate Your PHR Score & Study Hours by Domain
Adjust your practice scores across official PHR blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Do I Avoid Common Exam Traps?
The PHR exam tests judgment by presenting plausible but incorrect options. Understanding the traps beforehand is your best defense.
Trap 1: Confusing Data Privacy with Data Security
This is the single most common point of failure. Privacy is about policy and rights. Security is about technical and physical safeguards.
| Feature | Data Privacy | Data Security |
|---|---|---|
| Core Question | Who is authorized to access data and for what purpose? | How do we protect data from unauthorized access or threats? |
| Focus | Rights, policies, consent, legal compliance (HIPAA, GINA) | Safeguards, technology, physical controls, threat prevention |
| Example Violation | A manager accesses an employee's medical file without a legitimate business need. | A hacker breaches the server where employee medical files are stored. |
| HR Action | Discipline the manager, retrain on policy, review access rights. | Patch the vulnerability, activate incident response plan, notify affected parties. |
Trap 2: Misapplying the OSHA Hierarchy of Controls
When a question asks for the best way to address a hazard, it's testing your knowledge of this hierarchy. PPE is always the last and worst choice.
- Elimination: Physically remove the hazard. (Most effective)
- Substitution: Replace the hazard with a safer alternative.
- Engineering Controls: Isolate people from the hazard (e.g., machine guards, ventilation).
- Administrative Controls: Change how people work (e.g., training, job rotation).
- Personal Protective Equipment (PPE): Protect the worker with gear. (Least effective)
An exam question might offer "provide respirators" (PPE) as an option to deal with chemical fumes. The better answer will always be higher on the list, like "install a ventilation system" (Engineering Control).
What Are the Essential Cybersecurity Concepts for HR?
Beyond rules, you need to understand the frameworks for protecting HR data. Try VoraPrep's free PHR practice questions to see how these concepts are tested in scenarios.
The CIA Triad is a foundational model:
- Confidentiality: Preventing unauthorized disclosure of information. (Achieved via encryption, access controls).
- Integrity: Ensuring data is accurate and trustworthy. (Achieved via hashing, data validation).
- Availability: Ensuring authorized users can access data when needed. (Achieved via backups, disaster recovery).
But the exam expects you to know practical applications, too:
- Incident Response Plan: A documented plan for what to do in case of a data breach. Steps typically include: Containment, Eradication, Recovery, and Post-Incident Analysis.
- Employee Training: Recognizing phishing attempts and practicing good password hygiene are administrative controls that are critical first lines of defense.
- Access Control: Implementing the principle of "least privilege," where users only have access to the data absolutely necessary to perform their jobs.
- Multi-Factor Authentication (MFA): Requiring more than one method of verification to log in, significantly increasing security.
How Should I Use This Cheat Sheet?
This guide is your rapid-review tool, not a substitute for a complete study program.
- Before Practice Sets: Review this sheet before tackling a block of questions on these topics. It primes your brain to spot the patterns.
- Analyze Your Mistakes: When you get a question wrong, don't just look at the right answer. Use this sheet to identify the specific rule or framework you misapplied. Did you confuse privacy and security? Did you forget the I-9 retention rule?
- Create Flashcards: Turn every rule and threshold here into a flashcard. Active recall is proven to be more effective than passive reading. VoraPrep's complete course includes thousands of pre-built, FSRS Spaced-Repetition Flashcards that adapt to your memory curve.
A complete course like VoraPrep's integrates these concepts into a full study plan. Our platform offers textbook-grade interactive lessons, a Calibrated Pass-Readiness Score Predictor, and 1:1 exam simulators, providing a structured path to passing that avoids the fatigue of passive video lectures. You can even ask Vory, your 24/7 personal tutor, for step-by-step guidance on any topic.
Ready to Pass Your PHR Exam? VoraPrep provides a complete, interactive course with adaptive learning, detailed explanations, and 24/7 tutor support to ensure you're fully prepared. Stop watching boring videos and start learning actively. Visit voraprep.com to get started. Start Your Free 14-Day Trial at voraprep.com →