Which data-security practice protects EMS electronic records?

Which data-security practice protects EMS electronic records?

• A. Password policies only
• B. Physical security measures
• C. Access controls, authentication, encryption, audit logs, and regular security training
• D. Public cloud storage

Answer: (C)

This question tests how layered data-security practices protect EMS electronic records by combining access restrictions, identity verification, data protection, activity tracking, and staff training. The strongest approach includes: limiting who can reach patient information (access controls), proving who is logging in (authentication), protecting data from unauthorized access even if stolen (encryption), keeping a trail of who viewed or changed records (audit logs), and regularly educating staff on security best practices (security training). Together, these elements address both technical safeguards and human factors, reducing the risk of unauthorized access, breaches, and disclosures while supporting regulatory compliance. Password policies alone don’t control who can access information or verify identity beyond a login. Physical security measures protect the environment but don’t directly address electronic access or data protection. Public cloud storage can be secure if properly configured, but it isn’t inherently secure by itself and requires comprehensive controls—so it’s not enough on its own.

This question tests how layered data-security practices protect EMS electronic records by combining access restrictions, identity verification, data protection, activity tracking, and staff training. The strongest approach includes: limiting who can reach patient information (access controls), proving who is logging in (authentication), protecting data from unauthorized access even if stolen (encryption), keeping a trail of who viewed or changed records (audit logs), and regularly educating staff on security best practices (security training). Together, these elements address both technical safeguards and human factors, reducing the risk of unauthorized access, breaches, and disclosures while supporting regulatory compliance.

Password policies alone don’t control who can access information or verify identity beyond a login. Physical security measures protect the environment but don’t directly address electronic access or data protection. Public cloud storage can be secure if properly configured, but it isn’t inherently secure by itself and requires comprehensive controls—so it’s not enough on its own.