Which statement best differentiates privacy and security of PHI?

Which statement best differentiates privacy and security of PHI?

• A. Privacy is about encryption; Security is about passwords
• B. Privacy governs who can access PHI and how it is used; security encompasses the technical, physical, and administrative measures to protect PHI from unauthorized access
• C. PHI privacy and PHI security are identical concepts
• D. Security concerns only physical barriers

Answer: (B)

The main idea here is how PHI is protected in two related but different ways: privacy and security. Privacy refers to who is allowed to access PHI and for what purposes it can be used or disclosed, guided by policy and law (such as patient consent and HIPAA rules). Security refers to the actual safeguards that prevent unauthorized access, including technical measures (encryption, access controls, audit logs), physical protections (locked rooms, secure devices), and administrative processes (policies, training, risk assessments). The best statement clearly separates these roles: privacy sets the rules about who can see PHI and how it can be used; security provides the broad set of safeguards to keep PHI safe from unauthorized access. The other ideas mix up the concepts—encryption and passwords are specific security safeguards, not definitions of privacy, and treating privacy and security as identical or focusing only on physical barriers misses the full scope of both concepts.

The main idea here is how PHI is protected in two related but different ways: privacy and security. Privacy refers to who is allowed to access PHI and for what purposes it can be used or disclosed, guided by policy and law (such as patient consent and HIPAA rules). Security refers to the actual safeguards that prevent unauthorized access, including technical measures (encryption, access controls, audit logs), physical protections (locked rooms, secure devices), and administrative processes (policies, training, risk assessments).

The best statement clearly separates these roles: privacy sets the rules about who can see PHI and how it can be used; security provides the broad set of safeguards to keep PHI safe from unauthorized access. The other ideas mix up the concepts—encryption and passwords are specific security safeguards, not definitions of privacy, and treating privacy and security as identical or focusing only on physical barriers misses the full scope of both concepts.