Which category of safeguards primarily covers access controls and encryption?

• A. Administrative safeguards
• B. Physical safeguards
• C. Technical safeguards
• D. Organizational safeguards

Answer: (C)

Access controls and encryption are measures implemented directly in information systems to protect electronic protected health information. They fall under technical safeguards, which cover the technical means used to secure electronic data, including who can access it and how it remains confidential when stored or transmitted. Examples include unique user IDs and authentication, role-based access control, automatic logoff, and encryption of data at rest and in transit, along with related controls like audit logs and integrity checks. Administrative safeguards deal with policies, risk management, and training; physical safeguards protect the hardware and facilities; organizational safeguards cover governance and coordination with business associates. Because access controls and encryption are embedded in the system’s security features and manage access and confidentiality of data, they are categorized as technical safeguards.