ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The data elements described-patient diagnoses, laboratory results, and insurance information-are all considered electronic protected health information under U.S. law. The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for safeguarding the confidentiality, integrity, and availability of ePHI handled by covered entities and their business associates, including when that data resides in a public cloud such as AWS. PCI DSS is focused on payment card data, SOX addresses financial reporting controls for public companies, and FISMA applies to federal information systems; none of these specifically regulate the handling of medical records for private-sector healthcare providers. Therefore, HIPAA is the controlling regulation the security team must address.