Which of the following is considered an Administrative Safeguard type?

• A. Security management process
• B. Workforce security
• C. Contingency plan
• D. Device and media controls

Answer: (B)

Administrative safeguards are the policies and procedures that govern how an organization protects ePHI through people and processes. Workforce security, in particular, focuses on the actions and controls around the personnel who access ePHI—ensuring proper screening, role-based access, training, and ongoing management of user access. That makes it a quintessential example of Administrative safeguards because it centers on governance and human-related controls rather than on technical or physical measures.

The other choices illustrate Administrative safeguards as well (for example, security management process and contingency plan), but their focus is more on overarching governance and incident-ready procedures, while the last option belongs to Physical safeguards, which deal with physical controls around devices and media.