Which governance policy in health data aims to minimize re-identification risk in data-sharing?

• A. Access controls
• B. Patient visits
• C. Medication recalls
• D. Public disclosure of data

Answer: (A)

Limiting who can access health data and under what conditions is central to reducing re-identification risk when data is shared. Access controls enforce identity verification and authorization, so only people with a legitimate need-to-know can view the data. By using role-based or attribute-based access, organizations ensure that sensitive details are exposed only to those who truly need them, while access is monitored and revocable. This governance policy works alongside measures like least privilege, data use agreements, and audit trails to create a secure framework for sharing. The other options don’t target access: clinical processes like patient visits or medication recalls aren’t governance mechanisms, and publicly disclosing data would increase, not reduce, re-identification risk.