Which statement about the Security and Privacy Module is true?

• A. It mandates a single technical approach
• B. It does not mandate a single technical approach
• C. It requires encryption in all communications
• D. It prohibits audit logging

Answer: (B)

The key idea here is that security and privacy requirements are designed to be flexible, not prescriptive of one fixed technique. In healthcare data environments, systems vary widely in architecture, regulatory obligations, and risk profiles. The module sets goals like protecting confidentiality and integrity, ensuring proper authentication and authorization, enabling auditability, and supporting consent and data provenance. It allows multiple technical ways to meet those goals, so no single approach is mandated.

That’s why stating that there isn’t a single technical approach is the true takeaway. Saying all communications must be encrypted in every case isn’t required in every context, though encryption in transit is common. Prohibiting audit logging would run counter to the need for traceability and accountability. And insisting on one rigid technical method runs counter to the flexible, goal-based nature of security and privacy practices.