Which statement best describes physical security measures for healthcare data?

• A. They are irrelevant to data protection.
• B. They include barriers such as fences and alarms.
• C. They are only necessary in hospitals.
• D. They are mostly digital.

Answer: (B)

Physical security for healthcare data hinges on protecting the actual spaces and devices that store and access data. This means putting in place barriers and controls that prevent unauthorized physical access to servers, workstations, paper records, and storage media. Fences, controlled entry points, locked rooms, alarm systems, surveillance cameras, and security personnel all help ensure that only authorized people can reach the hardware and media that hold PHI. Without these physical safeguards, someone could bypass digital protections simply by gaining access to the equipment or storage, compromising data integrity and confidentiality. The other statements miss the mark because physical protection is not irrelevant, not limited to hospitals, and not primarily digital—physical safeguards are a foundational layer that supports overall data security.