Identify two privacy/security controls required under HIPAA for health information systems.

• A. Access controls (user authentication/RBAC) and encryption
• B. Open access for all staff and public posting of patient data
• C. Only audit trails
• D. Paper records only

Answer: (D)

HIPAA requires safeguards that protect electronic PHI in health information systems. Two fundamental technical controls are: implementing access controls (including strong user authentication and role-based access) so only authorized staff can view or modify PHI, and using encryption to protect PHI both at rest and in transit, so data remains confidential even if systems are breached. Open access or public posting violates privacy rules; audit trails matter but aren’t sufficient on their own, and relying on paper records only ignores the electronic environment and its protections. Together, access controls and encryption address who can access data and how securely it’s stored and transmitted.