When evaluating health information data security, which item is NOT typically considered?

When evaluating health information data security, which item is NOT typically considered?

• A. Salary for the database administrator
• B. Data loss risk assessment
• C. Access controls
• D. Encryption of data at rest

Answer: (A)

Evaluating health information data security focuses on the protections and processes that actually guard data and manage risk. A data loss risk assessment is a formal step that identifies threats, estimates likelihood and impact, and helps prioritize safeguards. Access controls are practical protections that enforce who can access or modify data. Encryption of data at rest is a direct security measure that protects stored information even if physical access to storage is gained. Salary for the database administrator, while it matters for budgeting and staffing, isn’t a security control or a risk mitigation activity and isn’t part of the typical security evaluation.

Evaluating health information data security focuses on the protections and processes that actually guard data and manage risk. A data loss risk assessment is a formal step that identifies threats, estimates likelihood and impact, and helps prioritize safeguards. Access controls are practical protections that enforce who can access or modify data. Encryption of data at rest is a direct security measure that protects stored information even if physical access to storage is gained. Salary for the database administrator, while it matters for budgeting and staffing, isn’t a security control or a risk mitigation activity and isn’t part of the typical security evaluation.