Which confidentiality measure is typically in place in EHR systems but often not activated or monitored?

• A. Audit-trail mechanisms
• B. Biometric authentication procedures
• C. Two-stage authentication procedures
• D. Remote monitoring devices

Answer: (A)

Audit-trail mechanisms in electronic health record systems are designed to record who accessed a patient’s record, when, from where, and what actions were taken. This creates an accountability log that helps detect inappropriate access and supports compliance with privacy regulations.

These logs are typically built into most EHR systems, but they’re often not activated or not actively monitored. Reasons include the sheer volume of log data, limited staff to review and investigate findings, and absence of clear procedures or alerts for suspicious activity. When auditing isn't turned on or logs aren’t regularly checked, the confidentiality safeguards exist in theory but don’t function effectively in practice, making it harder to detect and respond to potential breaches.

Biometric authentication and two-stage authentication are strong security measures, but they’re not as ubiquitously implemented or relied upon across all EHR environments, and they don’t by themselves provide an inherent audit record of access. Remote monitoring devices relate to monitoring patient status rather than controlling or documenting access to PHI within the EHR. The audit trail, by contrast, is the mechanism specifically focused on documenting every access to records, which explains why it’s the best answer here.