HIPAA addresses which aspect of health information in relation to covered entities?

• A. Privacy standards for patients
• B. Record retention requirements
• C. Use of disclosure of health information by covered entities
• D. Security of electronic health records

Answer: (C)

HIPAA's Privacy Rule governs how protected health information (PHI) may be used and disclosed by covered entities. It sets who may access PHI, what disclosures are permitted without patient authorization (for treatment, payment, and healthcare operations), and when patient authorization is required. It also establishes patient rights, notices of privacy practices, and the minimum necessary standard to limit exposed information. Because the focus is on how PHI can be shared or disclosed, this aspect is what HIPAA primarily addresses for covered entities.

Record retention is not dictated by HIPAA itself and depends on state laws and other regulations. Security of electronic health records is covered by the HIPAA Security Rule, which concentrates on safeguarding PHI rather than describing permissible disclosures.