In a medical office, what should a security policy protect?

• A. Encryption
• B. Patient Information
• C. Confidentiality
• D. Privacy Policy

Answer: (B)

In a medical office, the security policy is built to protect patient information. This includes electronic health records, test results, diagnoses, identifiers, and any data that could identify a patient. The policy specifies who can access that information, how it’s stored, transmitted, and disposed of, and what safeguards are required, such as access controls and encryption. Encryption is a tool used to safeguard the data, but it’s about protecting the information itself, not the policy’s object. Confidentiality describes the outcome we aim for—keeping patient information secret—but the policy’s focus is the information that needs protection. A privacy policy is a separate document that explains how data is collected and shared, not the daily security measures. Under HIPAA, protecting patient information (PHI) is essential, making patient information the central protected asset.