When conducting a HIPAA Security Risk Analysis, a covered entity must evaluate:
-
A
Only electronic records stored on hospital servers
-
B
All electronic protected health information (ePHI) created, received, maintained, or transmitted
-
C
Physical records and verbal disclosures only
-
D
Data held by business associates but not internal systems