According to ASTM EM31 Subcommittee on Health Informatics, confidentiality is defined as which of the following?

• A. Status accorded to data indicating that it is sensitive for some reason, and therefore it needs to be protected against theft, disclosure, or improper use, or both, and must be disseminated only to authorized individuals or organizations with a need to know
• B. Security measures that protect data and information from unauthorized access
• C. The right to limit disclosure of personal information
• D. Data privacy

Answer: (A)

Confidentiality means treating data as sensitive and restricting access to those who have a legitimate need to know. It emphasizes that the information should be protected against theft, disclosure, or improper use, and shared only with authorized individuals or organizations with a defined need to know. This framing matches health informatics goals: patient information must be shielded from unauthorized access and disclosed only to people involved in care or those authorized by policy.

Why this fits best: it directly links the data’s sensitive nature to restrictions on dissemination and access, which is the essence of confidentiality in health information practice. Other concepts describe related ideas but not the specific definition: security measures refer to safeguards protecting data from unauthorized access, privacy concerns the right to control disclosure of personal information, and data privacy is the broader notion of protecting personal information rather than the duty to limit access based on need to know. For a concrete example, a patient’s medical record should be accessible only to the treating clinicians and staff with a defined role, not to everyone, which embodies the confidentiality principle.