Privacy, Security, and Confidentiality of Records
Privacy and Security
This domain tests protection of personal, confidential, and sensitive records while preserving authorized access. Privacy governs what may be collected, used, shared, and kept; security governs how it is protected.
Core rules and concepts
- Privacy principles include lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. GDPR and CCPA/CPRA are examples; sector rules may add requirements.
- The security triad is confidentiality, integrity, and availability. Use risk assessment, access control with least privilege and role-based roles, authentication, encryption in transit and at rest, logging, and monitoring.
- Classify records as public, internal, confidential, or restricted, and apply handling rules to paper and electronic copies.
- Conduct privacy impact assessments for new systems; use data processing agreements with vendors; maintain breach response with notification timelines and documentation.
- Redaction must remove underlying data, not just cover it; test redacted files before release.
- Subject access and disclosure requests need identity verification, deadline tracking, exemption review, and a response log.
Worked example
A subject access request seeks an employee file containing a manager's investigation notes and a third party's statement. Verify identity, locate records across HR, email, and paper, review exemptions, redact third-party data where required, log the redactions and legal basis, respond within the statutory deadline, and retain the request file under schedule. The reasoning: access rights are not absolute; exemptions and third-party rights must be documented.
Traps
Equating privacy with security; keeping data just in case; over-redaction; ignoring paper and email; no vendor oversight; missing breach deadlines; using personal devices for records.