Which HIPAA rule focuses on safeguarding electronic health information?

• A. Privacy rules
• B. Breach notification rules
• C. Security rules
• D. Access rules

Answer: (C)

The main idea here is protecting electronic health information. That protection is provided by the HIPAA Security Rule, which sets national standards for securing ePHI created, received, used, or maintained by covered entities and business associates. It requires safeguards across three areas: administrative, physical, and technical. Examples include conducting a risk analysis, implementing access controls and authentication, maintaining audit controls, ensuring data integrity, and securing transmissions.

The Privacy Rule governs how PHI can be used and disclosed and protects patient privacy more broadly, not specifically the technical safeguards for electronic data. The Breach Notification Rule deals with if and when breaches must be reported. There isn’t a formal HIPAA rule called an “Access Rule.” Because the question asks about safeguarding electronic health information, the Security Rule is the best fit.