Which practice represents an Administrative Safeguard under the HIPAA Security Rule?

• A. Designating a security officer with defined responsibilities.
• B. Encrypting data at rest and in transit.
• C. Securing physical equipment.
• D. Using a risk analysis toolkit from NIST.

Answer: (A)

Administrative safeguards focus on how the organization governs and manages security—policies, procedures, and clear accountability. Designating a security officer with defined responsibilities provides explicit accountability for developing, implementing, and maintaining the security program, coordinating risk assessments, training, and incident response. That clear assignment of responsibility embodies the governance and oversight role that Administrative Safeguards are meant to ensure.

Encryption of data at rest and in transit is a Technical Safeguard because it protects the data itself through cryptography. Securing physical equipment is a Physical Safeguard, covering the protection of facilities and devices. A risk analysis toolkit from NIST relates to performing risk assessment, which supports the Administrative Safeguard function, but the direct act of naming a security officer best exemplifies the governance aspect that characterizes Administrative Safeguards.