Which of the following is NOT listed as a type of Technical safeguards?

• A. Access control
• B. Audit controls
• C. Integrity
• D. Risk assessment

Answer: (D)

Technical safeguards are the technology-based protections in the HIPAA Security Rule, covering controls like access control, audit controls, integrity, authentication, and transmission security. The item tests which of these is not a technical safeguard. A risk assessment (risk analysis) is an Administrative safeguard, focusing on policies, procedures, and ongoing processes to identify and manage risks to ePHI. It’s about governance and planning, not a specific technical control. The other options fit squarely as technical safeguards: access control restricts who can view or use ePHI; audit controls enable monitoring and recording of activity; integrity protects data from improper alteration or destruction; and transmission security safeguards data in transit. So risk assessment is the one that isn’t a technical safeguard.