ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Laboratory results tied to a patient's identity meet the definition of protected health information because they contain medical details linked to an individual identifier (e.g., name, medical record number). HIPAA and NIST SP 800-60 both treat such data as PHI, triggering health-care-specific privacy and security requirements. Although the records also contain personally identifiable information, the presence of detailed medical content elevates them into the PHI category. They are not primarily financial data subject to PCI DSS, nor do they fit the broader federal Controlled Unclassified Information designation, and they are not proprietary business secrets.