Data Classification for Patient Health Information

SY0-701 By islever Editorial Last updated

Compare and contrast concepts and strategies to protect data.

Short answer

C Sensitive data classification should be used to secure patient data containing Protected Health Information (PHI).

Question

A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?
  1. Private
  2. Critical
  3. Sensitive Correct Answer
  4. Public

Key Takeaways

Tests the ability to distinguish between data sensitivity levels, specifically recognizing that PHI falls under the Sensitive category rather than Public or Critical availability-focused classifications.

Patient data in a hospital setting is classified as Sensitive due to the presence of Protected Health Information (PHI). This question establishes that Sensitive classification is required to secure individual privacy rights.

Common mistake: Learners often select 'Private' or 'Critical'. 'Private' is not a standard enterprise classification tier in most frameworks (which use Public, Internal, Confidential, Restricted), and 'Critical' refers to availability/business continuity needs, not confidentiality.

Expert Analysis

Why the Answer Is Correct

Correct answer: C — Sensitive data includes Personally Identifiable Information (PII) and Protected Health Information (PHI), which require strict access controls and encryption to prevent unauthorized disclosure. In healthcare environments, patient records are inherently sensitive because their compromise leads to significant harm to individuals.

Why the Other Options Are Wrong

A. Private is not a standard formal classification level in most security frameworks (typically: Public, Internal, Confidential, Restricted). B. Critical refers to data essential for business operations where availability is paramount, not necessarily confidentiality. D. Public data has no restrictions on access, which would be a severe compliance violation for patient records.

Community Comment Notes

The community consensus strongly supports 'Sensitive' as it aligns with standard definitions involving PII and PHI. As noted by user Osechabelo, sensitive data explicitly covers intellectual property, PII, and PHI. User HungryRightNow clarified the distinction: Sensitive relates to individual information, while Critical relates to company trade secrets.

Exam Strategy

When classifying data, always look for keywords indicating privacy risks like 'patient', 'financial', or 'employee'. If the data involves personal attributes, it is almost certainly 'Sensitive' or 'Confidential'. Avoid 'Critical' unless the question emphasizes uptime or business continuity over secrecy.

Frequently Asked Questions

Why isn't patient data classified as 'Critical'?

'Critical' typically refers to data whose unavailability causes immediate business failure. Patient data is primarily about confidentiality (privacy), making it 'Sensitive'.

Is 'Private' a valid data classification?

In most enterprise frameworks (like NIST or CIS), 'Private' is not a standard tier. Standard tiers are usually Public, Internal, Confidential, and Restricted/Top Secret.

More SY0-701 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Osechabelo 👍 21
    C. Sensitive Sensitive - Intellectual property, PII, PHI • Confidential - Very sensitive, must be approved to view • Public / Unclassified - No restrictions on viewing the data • Private / Classified / Restricted – Restricted access, may require an NDA • Critical - Data should always be available
  2. HungryRightNow 👍 3 Answered C
    Sensitive data = Individual's important information (PII) Critical data = The company's important information (Trade secrets)
  3. e5c1bb5 👍 2 Answered C
    Sensitive - Intellectual property, PII, PHI
  4. jade290 👍 1 Answered C
    C is correct. Sensitive * Information that, if disclosed or compromised, could cause significant harm to individuals, organizations, or national security. Examples: · Personally identifiable information (PII) such as social security numbers, health records, financial information · Trade secrets, intellectual property, government classified information
  5. shady23 👍 2 Answered C
    C. Sensitive -phi

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide