| Course | HI575 Protection of Health Information |
|---|---|
| Unit | Unit 6 |
| Paper type | Technical safeguards brief |
| Length | About 840 words, 6 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | MS in Health Informatics |
| Updated | October 2026 |
Free sample paper for HI575 Unit 6
What Each Control Blocks and What It Leaves Open: A Unit 6 Technical Safeguards Brief for an Orthopedic Practice Administrator
[Student Name]
Purdue University Global
HI575: Protection of Health Information
Unit 6 Technical Safeguards Brief
[Instructor Name]
[Date]
Tollbridge Orthopedic Group, its controls and every cost estimate are composite; the rule and sources cited are real.
Memorandum
To: Practice Administrator
From: Privacy and Security Officer
Re: Six technical safeguards proposed for this year's budget
Summary
Six controls are proposed, at an estimated first-year cost of 64,000 to 91,000 dollars. Together they address the three high-band exposures in the risk matrix, the imaging archive, email takeover and unencrypted laptops, and three moderate ones. Each paragraph below says what the control does, what it blocks, what it leaves open and who will operate it.
The Six Controls
Encryption at rest on all surgeon laptops. Answers matrix row 5. Encrypts the whole drive so that a lost or stolen laptop reveals nothing without the user's sign-in. Blocks disclosure after theft. Leaves open any authorized user copying data elsewhere while signed in. Operated by the IT contractor, with a monthly report confirming all eleven laptops are encrypted. Estimated cost 2,000 to 4,000 dollars, mostly setup time.
Multifactor sign-in for email and all remote access. Answers rows 3 and 4. Requires a second step, such as an app prompt, after the password. Blocks reuse of a phished or guessed password. Leaves open a user tricked into approving a prompt they did not start. Operated by the IT contractor; staff need a short briefing on rejecting unexpected prompts. Estimated cost 9,000 to 14,000 dollars a year in licenses.
Blocking automatic forwarding to outside addresses. Answers row 4. Prevents any mailbox rule from silently sending copies outside the practice. Blocks the quiet, ongoing leak that a compromised account can set up. Leaves open a user manually forwarding a message, which is visible and logged. Operated by the IT contractor. Estimated cost negligible; it is a setting.
Isolating and replacing the imaging archive. Answers rows 1 and 2. Moves the archive onto a separate network segment, makes vendor access available only for scheduled sessions, and replaces the unsupported server this year. Blocks the path from an always-open vendor connection to the rest of the network. Leaves open an attack that arrives through a surgeon's workstation that is allowed to view images. Operated by the IT contractor with the imaging vendor. Estimated cost 40,000 to 55,000 dollars, most of it the server replacement.
Audit log review for the health record and imaging archive. Answers row 7 and supports row 6. Logs already exist; the control is a weekly review of alerts for access to staff members' own records, charts sharing a surname with the employee opening them, and unusually large lookups. Blocks nothing by itself. It becomes detection only when someone reads the alerts. Operated by the privacy officer, two hours a week. Estimated cost 6,000 to 8,000 dollars a year in staff time and an alerting add-on.
Badge tap sign-in at front desk workstations. Answers row 8. Lets a receptionist switch users in two seconds, replacing the shared account. Blocks untraceable changes and gives each person a record of their own actions. Leaves open a user who walks away without tapping out, though the screen locks after two minutes. Operated by the front desk lead. Estimated cost 7,000 to 10,000 dollars for readers and setup.
Audit logging is the easiest control to buy and the easiest to leave unread, so the brief funds the reviewer's time, not the software.
The Table in Brief
1. Laptop encryption: blocks theft disclosure; leaves open authorized copying.
2. Multifactor sign-in: blocks stolen passwords; leaves open approved fake prompts.
3. Forwarding block: blocks silent external copies; leaves open manual forwarding.
4. Archive isolation and replacement: blocks the vendor path; leaves open workstation-borne attacks.
5. Audit review: blocks nothing alone; detects misuse when read.
6. Badge sign-in: blocks untraceable shared use; leaves open unattended sessions.
What These Controls Do Not Address
Two exposures need non-technical answers. The billing specialist who exports a claims report and emails it to a personal account, row 17, is better addressed by limiting the export privilege, which the access control policy already does. The texting vendor without a business associate agreement, row 13, needs a contract, not a control.
Why These Six
The Security Rule names access control, audit controls, integrity, person or entity authentication and transmission security as technical safeguards, and treats encryption as an addressable specification that a practice must implement where reasonable or document why not (45 C.F.R. § 164.312, 2024). The federal health care cybersecurity practices name email protection, endpoint protection and access management among the top threats and responses for small and medium practices (Health Sector Coordinating Council, 2023), and the resource guide for the Security Rule ties each safeguard to the risks it reduces (Marron, 2024). These six match the matrix's highest rows to those practices.
Decision Requested
Approve all six for this fiscal year, with the archive replacement scheduled first.
References
45 C.F.R. § 164.312 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312
Health Sector Coordinating Council. (2023). Health industry cybersecurity practices: Managing threats and protecting patients (2023 edition). U.S. Department of Health and Human Services, 405(d) Program.
Marron, J. A. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST Special Publication 800-66r2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-66r2
HI575 Unit 6 instructions, in plain terms
Unit 6 commonly asks you to recommend technical safeguards that address the highest risks from your matrix, written for an administrator or executive. Expect a summary, a description of each control, a comparison table and a short justification tied to the Security Rule or a framework. Four pages is common. Begin with the decision the reader must make. For each control, say which risk it answers, what it does in plain words, what it blocks and what it leaves open, and who will run it. Give cost ranges where possible. Be honest about controls that only detect. Note any risks that need non-technical answers, such as contracts or permission changes.
How this HI575 Unit 6 example is built
The memo opens with a summary of six controls and their first-year cost range. Six paragraphs follow in the same order, covering laptop encryption, multifactor sign-in, blocking outside forwarding, archive isolation and replacement, audit log review and badge sign-in, each naming its matrix row, function, protection, gap, operator and cost. The highlighted sentence explains why the brief funds a reviewer's time rather than software. A six-line table condenses the paragraphs. A section sends claims export and the texting vendor to permissions and a contract. The justification draws on the Security Rule's technical safeguard standards and national health care cybersecurity practices, and the memo closes with the decision requested.
Where the points sit in the HI575 Unit 6 rubric
Technical safeguards briefs are usually scored on alignment with the risk analysis, clarity for the intended reader, candor about limitations, practical detail and writing. Alignment and candor often weigh most: graders reward controls tied to specific matrix rows and an honest account of what each leaves open. Clarity is judged on whether a non-technical administrator could follow every paragraph. Practical detail includes operators and costs. Justification against the Security Rule earns credit. A summary that states the decision first is expected. Correct citations complete the rubric. Briefs that read like product brochures, or that promise a control will prevent all breaches, tend to lose points. Clear cost ranges and named operators are what turn a list of products into a decision the administrator can actually approve.
HI575 Unit 6 help from the desk
Briefs in this unit are frequently returned for listing technologies without linking them to the organization's risks. Another weakness is technical language the intended reader cannot follow. Some students describe only what controls block, never what they leave open. Detection controls are often presented as if buying them were enough. Costs and operators are commonly missing. Risks that need contracts or policy changes get forced into technical answers. If your matrix ranked different risks at the top, such as medical devices or a cloud archive, send the high rows and we will match a control set to them. Leaving out who reviews alerts and how often is the single gap graders flag most in this brief.
Get an HI575 Unit 6 example written to your instructions
Controls only make sense against the risks your own matrix rated. Forward those ratings with your Unit 6 instructions and the rubric, and a custom brief comes back inside 24-48h pairing each safeguard with what it blocks and what it leaves open. There is no charge for the first one. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More HI575 papers and MS in Health Informatics samples
- HI575 Unit 1: Discussion Board Post
- HI575 Unit 2: Data Inventory
- HI575 Unit 3: Threat and Vulnerability Analysis
- HI575 Unit 4: Risk Analysis Matrix
- HI575 Unit 5: Access Control Policy
- HI575 Unit 7: Incident Response Plan
- HI575 Unit 8: Seminar Reflection
- HI575 Unit 9: Contingency and Recovery Plan
- HI575 Unit 10: Security Risk Assessment Report
- HI570 Unit 6: Secondary Use Evaluation
- HI560 Unit 6: Population Comparison
- HI501 Unit 6: Adoption Evaluation
- HI555 Unit 6: Appeal Letter
HI575 Unit 6 questions, answered
Which technical safeguards does the Security Rule name?
The technical safeguard standards cover access control, audit controls, integrity, person or entity authentication and transmission security, each with implementation specifications beneath it. The example cites them by standard and then argues from the matrix rather than from the list, since a brief that walks the regulation in order tends to recommend controls the organization's own risks never called for.
Should the brief include vendor product names?
Rarely necessary. Controls are described by function, full-disk encryption, multifactor sign-in, centralized logging, so the brief stays accurate whatever product the organization chooses. If your prompt asks for specific products, name them in a separate column with the date the information was checked, and keep the argument about what each control blocks independent of any brand.
How technical should the language be?
Pitched at the named reader. The example's audience is a practice administrator, so each control is explained in a sentence of plain language before any term appears, and acronyms are spelled out once. Where a prompt names an IT audience, more precision is welcome, but the pairing of control, exposure closed and exposure left open should read clearly either way.
Where can I find a free HI575 Unit 6 sample paper?
This page contains the complete Unit 6 brief, pairing six controls with what each blocks and leaves open for a practice administrator.
Does audit logging protect health information by itself?
No. Logs only become a safeguard when someone reviews the alerts on a schedule and acts on them, so the reviewer's time matters as much as the software.