Which of the following best describes the purpose of security in health information systems?

• A. To maximize data collection without privacy concerns
• B. To enable public sharing
• C. To reduce data retention
• D. To protect both the system and the information from unauthorized access and misuse, thereby protecting privacy

Answer: (C)

Security in health information systems is about safeguarding both the system and the data it holds from unauthorized access and misuse, which directly protects patient privacy. This means ensuring that only authorized individuals can view or change information, keeping data accurate, and keeping the system available to those who need it without exposing it to risks. This focus on preventing breaches and wrong use is what preserves trust and helps meet privacy and legal requirements.

Choosing a description that emphasizes maximizing data collection without privacy concerns misses the fundamental purpose of security, which is to protect privacy. Describing security as enabling public sharing runs counter to privacy protections, since health data are typically confidential. Framing security as simply reducing data retention leans more toward data governance or privacy practices, not the core aim of security itself.