Which mechanism is primarily used to enforce who can access patient data and what they can do?

• A. Backups
• B. User authentication
• C. Access controls
• D. Data redundancy

Answer: (C)

Access controls are the mechanism that regulates who can access patient data and what actions they’re allowed to perform. They work by enforcing both authentication and authorization. First, a user proves their identity (authentication); then the system checks what that user is permitted to do based on their role, attributes, or other rules (authorization). This combination ensures that only the right people can access sensitive information and only in ways appropriate to their duties.

Backups and data redundancy relate to data availability and integrity, not access rights, while user authentication verifies identity but doesn’t itself determine exact permissions.