Which of the following is NOT a technical security control employed by electronic health record systems?

• A. User authentication via strong passwords
• B. Audit trails
• C. Role-based access control
• D. Automatic logon

Answer: (D)

Security controls in electronic health record systems are meant to verify who is using the system, restrict what they can access, and keep a trace of those actions. Requiring strong password authentication is a fundamental technical control that confirms identity. Audit trails are essential for accountability and forensic checks, showing who did what and when. Role-based access control enforces privileges based on a user’s job, ensuring people only access data necessary for their role. Automatic logon, however, bypasses authentication and undermines both identity verification and the ability to track activities, so it isn’t considered a technical security control in this context.