Which HIPAA principle includes access controls, authentication, and audit trails, but not off-site data storage?

• A. Boundaries
• B. Privacy
• C. Security
• D. Public Responsibility

Answer: (A)

This focuses on the HIPAA technical safeguards that protect electronic PHI. The controls listed—access controls, authentication, and audit trails—are classic elements of the HIPAA Security Rule, which specifies technical measures to ensure only authorized individuals can access data, verify who is accessing information, and record activity for accountability. Importantly, these safeguards apply to all formats and locations of electronic PHI, including off-site storage and backups, so they don’t exclude off-site data.

Boundaries relates to how information is shared and who may have access from a privacy perspective, not the technical protections used to safeguard data. Privacy focuses on patient rights and the permissible uses and disclosures of PHI, rather than the specific technical controls. Public Responsibility is not a formal HIPAA category focused on how ePHI is protected.