Question

A hospital is deploying a new electronic health records (EHR) system. The Chief Medical Officer decides which staff roles may view patient records and sets the sensitivity level for the data. The IT operations team configures the database access control lists, runs nightly backups, and applies encryption at rest per policy. During an audit, a reviewer asks who is accountable for defining the appropriate protection requirements for the patient data. Which party holds this responsibility?

Accepted Answer

The Chief Medical Officer, acting as the data owner who classifies the data and defines protection requirements

Answer

The IT operations team, because they implement the encryption and backups that protect the data

Answer

The database administrator, as the data custodian who maintains day-to-day access controls

Answer

The audit reviewer, who validates that protection requirements are adequate