Under HIPAA, which rule establishes safeguards for electronically protected health information?

Under HIPAA, which rule establishes safeguards for electronically protected health information?

• A. The Privacy Rule
• B. Public Records Law
• C. The Security Rule
• D. The Sunshine Law

Answer: (C)

The main idea is that HIPAA’s Security Rule sets the required safeguards for electronically protected health information. It targets e-PHI and requires administrative, physical, and technical measures to protect it from unauthorized access, use, or disclosure. Think of administrative safeguards as the policies and procedures you put in place—things like risk analyses, security management processes, training, and incident response. Physical safeguards cover how you physically protect systems and data—the facilities, workstation setup, and how devices and media are controlled. Technical safeguards are the actual security technologies and controls—access controls, unique user IDs, encryption where appropriate, audit controls, integrity checks, authentication, and secure transmission. The overarching goal is to keep e-PHI confidential, intact, and available when needed. This is different from the Privacy Rule, which governs how PHI can be used and disclosed, and from non-HIPAA laws such as Public Records Law or the Sunshine Law.

The main idea is that HIPAA’s Security Rule sets the required safeguards for electronically protected health information. It targets e-PHI and requires administrative, physical, and technical measures to protect it from unauthorized access, use, or disclosure. Think of administrative safeguards as the policies and procedures you put in place—things like risk analyses, security management processes, training, and incident response. Physical safeguards cover how you physically protect systems and data—the facilities, workstation setup, and how devices and media are controlled. Technical safeguards are the actual security technologies and controls—access controls, unique user IDs, encryption where appropriate, audit controls, integrity checks, authentication, and secure transmission. The overarching goal is to keep e-PHI confidential, intact, and available when needed. This is different from the Privacy Rule, which governs how PHI can be used and disclosed, and from non-HIPAA laws such as Public Records Law or the Sunshine Law.