According to the HIPAA Security Rule, Administrative Safeguards refer to which concept?

• A. Physical safeguards for facilities.
• B. Technical safeguards and user access controls only.
• C. Administrative Safeguards are administrative actions, and policies and procedures, to manage the security of electronic protected health information and the conduct of the workforce.
• D. Public health reporting requirements.

Answer: (C)

Administrative safeguards focus on the processes and policies that protect ePHI and govern the actions of the workforce. They involve security management processes, risk analysis and risk management, workforce training and management, access authorization and change-management procedures, incident response and reporting, contingency planning, and business associate agreements. This description directly matches the idea of administrative actions and policies to manage the security of electronic protected health information and how the staff should conduct themselves, which is exactly what Administrative Safeguards are meant to cover.

Physical safeguards are about the secure physical environment—facilities, hardware, and physical access controls—while technical safeguards deal with the technology itself, such as access controls, encryption, and audit controls. Public health reporting requirements lie outside the Security Rule’s safeguards; they are regulatory obligations that don’t define administrative safeguards.