Which choice best describes a key attribute of privacy by design in health IT?

• A. Delaying privacy decisions until after deployment.
• B. Privacy is optional in system design.
• C. Privacy and security controls are integrated from the outset, reducing risk.
• D. Privacy concerns are addressed only after a data breach.

Answer: (C)

Privacy by design means building privacy and security protections into every step of creating a health IT system, not adding them as an afterthought. In health care, where patient data are highly sensitive, this approach helps protect information from the start, enforces proper access controls, and reduces the chance of breaches and noncompliance by guiding decisions about data collection, use, and sharing early on. The best option describes integrating privacy and security controls from the outset, which lowers risk through default protections, careful data handling, and ongoing risk management. Delaying privacy decisions, treating privacy as optional, or addressing privacy only after a data breach are reactive, increase risk, and harm patient trust.