An advantage of an identity and access management (IAM) system is that the IAM system

• A. Meets HIPAA's Privacy Rule requirements regarding identification
• B. Satisfies CFR Title 21 Part 11
• C. Provides HIPAA-required encryption for PHI
• D. Meets HIPAA's Security Rule requirements regarding access to PHI

Answer: (D)

The main idea is that securing who can access health information is a core aim of the HIPAA Security Rule. An identity and access management system centralizes authentication and authorization, so you can verify who a user is and precisely control what parts of PHI they may view or modify. This directly enforces access controls for ePHI, supports least-privilege principles, and provides audit trails—precisely what the Security Rule requires for protecting information.

Other options fit less well. The Privacy Rule governs patient rights and the permissible disclosures of PHI, not the technical mechanism for controlling access. CFR Title 21 Part 11 deals with electronic records and signatures in FDA-regulated contexts, not the general HIPAA security framework. Encryption is important, but HIPAA treats it as an implementation option that may be required based on risk; an IAM system itself emphasizes access control rather than guaranteeing encryption.