What are common security controls for protecting PHI in UHC operations?

• A. Access controls, encryption, audit trails, secure communications, and employee training.
• B. Blockchain ledgers and public cloud storage only.
• C. No security controls are required for PHI.
• D. Physical security only, with no digital protections.

Answer: (A)

Protecting PHI relies on layered controls that cover people, processes, and technology. Access controls ensure only authorized staff can view PHI, so data is not exposed to anyone who doesn’t need it. Encryption keeps data unreadable if it’s stolen or accessed without permission, whether it’s stored or moving between systems. Audit trails record who did what with PHI, providing accountability and helping detect unusual or unauthorized activity. Secure communications protect data in transit—such as between clinics, hospitals, and cloud services—from interception. Employee training reinforces proper handling of PHI, teaches recognizing phishing and social engineering, and promotes adherence to security policies. Taken together, these practices form a practical, effective approach for safeguarding PHI in UHC operations. The other options fall short because they either rely on too narrow a set of controls (like only blockchain and public cloud), claim no controls are needed, or focus only on physical security without digital protections.