Which of the following is a comprehensive security control for protecting PHI?

• A. Audit trails
• B. Public data exposure
• C. Access controls, encryption, audit trails, secure communications, and employee training
• D. No monitoring or logging

Answer: (C)

Protecting PHI requires a layered approach that combines multiple security measures rather than relying on a single control. The best choice brings together access controls to limit who can view PHI, encryption to protect data at rest and in transit, audit trails to record and monitor activity, secure communications to safeguard data as it moves, and ongoing employee training to reduce human error and improve security awareness. This combination supports confidentiality, integrity, and accountability, making it a comprehensive security stance for PHI.

A single control like audit trails only helps you see what happened but doesn’t prevent access or protect data in transit. Public exposure is the exact opposite of protection. No monitoring or logging leaves you without visibility to detect or respond to incidents.