200-201 Security Concepts Practice Question
Which compliance framework is specifically designed to protect the privacy and security of electronic health information in the United States?
⚠ Common exam trap
200-201 often tests the confusion between general data protection regulations (GDPR) and sector-specific US laws (HIPAA), so candidates must anchor on the phrase 'electronic health information in the United States.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is the US federal law that specifically governs the privacy and security of protected health information (PHI) held by covered entities and business associates. It defines the Privacy Rule, Security Rule, and Breach Notification Rule, making it the direct answer for electronic health information in the United States. GDPR, ISO 27001, and PCI DSS address different scopes and jurisdictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GDPR
Why it's wrong here
GDPR is European Union law governing personal data of EU residents, with no US health-sector remit. It tempts because it is a prominent privacy regulation imposing security duties, and would be correct for an organisation processing EU personal data rather than one handling US electronic protected health information.
- ✗
ISO 27001
Why it's wrong here
ISO 27001 is a voluntary international information security management standard certifying an organisation's ISMS, not US health privacy legislation. It tempts because it covers security controls broadly, and would be correct for demonstrating a certifiable security management system rather than meeting US electronic health record privacy obligations.
- ✓
HIPAA
Why this is correct
HIPAA, the Health Insurance Portability and Accountability Act, sets the US legal requirements for safeguarding protected health information held by covered entities and their business associates. Its Privacy and Security Rules specifically govern electronic health records, matching the scenario's demand for a US health-data framework.
- ✗
PCI DSS
Why it's wrong here
PCI DSS governs payment card data security, applying to any entity storing, processing or transmitting cardholder data, not electronic health information. It tempts because it is a widely mandated US compliance framework, and would be correct for a retailer or payment processor handling card transactions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.