An advantage of an identity and access management (IAM) system is that it ______.

• A. HIPAA-required encryption for PHI
• B. meets HIPAA's Security Rule requirements regarding access to PHI
• C. meets HIPAA's Privacy Rule requirements regarding identification
• D. Code of Federal Regulations Title 21, Part 11

Answer: (B)

Identity and access management systems focus on who is allowed to access PHI and under what conditions. This directly supports the HIPAA Security Rule, which requires technical safeguards like access controls, authentication, and audit controls to protect electronic PHI. By centralizing identity verification and enforcing role‑based access, IAM ensures that only authorized users can reach PHI and that access is traceable, reducing the risk of unauthorized disclosure or tampering.

Encryption is essential for protecting data, but it’s a protective measure that can operate independently of IAM. The key value of IAM is not encryption itself but the ability to enforce who can access data and to log those access events. The Privacy Rule concerns patient rights and permissible uses and disclosures of PHI rather than access control mechanisms. FDA Part 11 deals with electronic records and signatures under FDA oversight, which is not the HIPAA framework applicable here.