What is the difference between 'privacy' and 'security' under HIPAA?

• A. Privacy governs the use and disclosure of PHI; security safeguards electronic PHI with technical and administrative controls.
• B. Privacy covers only paper records.
• C. Security governs the use and disclosure of PHI.
• D. Security handles only non-electronic records.

Answer: (A)

HIPAA distinguishes two roles: privacy covers how PHI is used and disclosed, setting who can access information and under what circumstances; security protects electronic PHI from unauthorized access, breaches, and other threats through administrative, physical, and technical safeguards. The statement that privacy governs use and disclosure and security safeguards electronic PHI with technical and administrative controls captures these roles accurately. Privacy applies to PHI in any format, not just paper, and security is specifically about electronic data—not non-electronic records.