Authentication ensures that a user is permitted access to specific PHI.

Authentication ensures that a user is permitted access to specific PHI.

• A. True
• B. False
• C. Not necessary for access control
• D. Requires biometric

Answer: (B)

Authentication verifies who the user is, but it does not by itself grant permission to view specific PHI. After someone is authenticated, the system must check authorization and enforce access controls to decide which PHI they may access. So being authenticated is a prerequisite, not a guarantee of access. For example, a clinician might log in successfully (authentication) but will only be able to see records they’re authorized to access. Biometric methods are just one way to authenticate; credentials like passwords or tokens can also be used, and biometrics aren’t required.

Authentication verifies who the user is, but it does not by itself grant permission to view specific PHI. After someone is authenticated, the system must check authorization and enforce access controls to decide which PHI they may access. So being authenticated is a prerequisite, not a guarantee of access. For example, a clinician might log in successfully (authentication) but will only be able to see records they’re authorized to access. Biometric methods are just one way to authenticate; credentials like passwords or tokens can also be used, and biometrics aren’t required.