Data Classification for Patient Health Information
A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the ability to distinguish between data sensitivity levels, specifically recognizing that PHI falls under the Sensitive category rather than Public or Critical availability-focused classifications.
Patient data in a hospital setting is classified as Sensitive due to the presence of Protected Health Information (PHI). This question establishes that Sensitive classification is required to secure individual privacy rights.
Learners often select 'Private' or 'Critical'. 'Private' is not a standard enterprise classification tier in most frameworks (which use Public, Internal, Confidential, Restricted), and 'Critical' refers to availability/business continuity needs, not confidentiality.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: C — Sensitive data includes Personally Identifiable Information (PII) and Protected Health Information (PHI), which require strict access controls and encryption to prevent unauthorized disclosure. In healthcare environments, patient records are inherently sensitive because their compromise leads to significant harm to individuals.Why the Other Options Are Wrong
A. Private is not a standard formal classification level in most security frameworks (typically: Public, Internal, Confidential, Restricted). B. Critical refers to data essential for business operations where availability is paramount, not necessarily confidentiality. D. Public data has no restrictions on access, which would be a severe compliance violation for patient records.Community Comment Notes
The community consensus strongly supports 'Sensitive' as it aligns with standard definitions involving PII and PHI. As noted by user Osechabelo, sensitive data explicitly covers intellectual property, PII, and PHI. User HungryRightNow clarified the distinction: Sensitive relates to individual information, while Critical relates to company trade secrets.Exam Strategy
When classifying data, always look for keywords indicating privacy risks like 'patient', 'financial', or 'employee'. If the data involves personal attributes, it is almost certainly 'Sensitive' or 'Confidential'. Avoid 'Critical' unless the question emphasizes uptime or business continuity over secrecy.
Frequently Asked Questions
Why isn't patient data classified as 'Critical'?
'Critical' typically refers to data whose unavailability causes immediate business failure. Patient data is primarily about confidentiality (privacy), making it 'Sensitive'.
Is 'Private' a valid data classification?
In most enterprise frameworks (like NIST or CIS), 'Private' is not a standard tier. Standard tiers are usually Public, Internal, Confidential, and Restricted/Top Secret.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →