Which statement about HIPAA is true?

• A. HIPAA regulates both security and privacy of health information.
• B. HIPAA does not regulate privacy.
• C. HIPAA applies only to hospitals.
• D. HIPAA only concerns billing practices.

Answer: (A)

HIPAA establishes nationwide standards to protect patient health information, addressing both privacy and security. The privacy rule governs how PHI can be used and disclosed and grants patients rights over their records, while the security rule requires safeguards—administrative, physical, and technical—for electronic PHI. This framework applies to covered entities (like health plans and providers that transmit health information electronically) and their business associates, not just hospitals or billing activities. Because it recognises both privacy protections and security safeguards across a broad set of entities and scenarios, the statement that HIPAA regulates both security and privacy is the accurate one.