Which statement best describes the purpose of Access Control within Technical safeguards?

• A. Protects data from being stolen physically
• B. It ensures only authorized individuals can access data
• C. It encrypts data in transit and at rest
• D. It governs how long records are kept

Answer: (B)

Access control in Technical safeguards is about ensuring that only authorized individuals can access protected data. It does this by verifying identity (authentication) and granting rights (authorization) based on role and need to know, so every access to data is by someone who has a legitimate reason and permission to view or interact with it. The other options describe different protections: physical protection of data, encryption of data in transit and at rest, and retention or records management policies. For example, a clinician logs in, is authenticated, and is allowed to view a patient chart, while someone without the appropriate role is barred from accessing that information.