CAS-004 Governance, Risk, and Compliance Practice Question
A healthcare organization subject to HIPAA must ensure that patients can access their medical records. This requirement is an example of which data subject right under privacy regulations?
⚠ Common exam trap
CAS-005 often tests the distinction between the right to access and the right to data portability — candidates conflate 'getting my data' with portability, but access is simply viewing/receiving a copy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Right to access
The right to access under privacy regulations (including HIPAA's patient rights and GDPR Article 15) gives individuals the ability to obtain a copy of their personal data and confirm what is being processed. HIPAA's Privacy Rule specifically grants patients the right to inspect and obtain a copy of their protected health information. This maps directly to the right to access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Right to be forgotten
Why it's wrong here
Erasure lets individuals request deletion of personal data; HIPAA access requires providing records, not removing them. Medical retention obligations often prohibit deletion outright. Erasure would be the right concept where a data subject asks an organisation to delete their personal information under a regulation granting that right.
- ✗
Right to data portability
Why it's wrong here
Portability concerns transmitting data to another controller in a structured, machine-readable format, not viewing one's own records. HIPAA access is about inspection and copies, so portability mischaracterises it. Portability would apply where a patient moves records to a different provider or system.
- ✗
Right to rectification
Why it's wrong here
Rectification covers correcting inaccurate or incomplete records, not granting access. HIPAA's access right corresponds to the right of access, so this option mislabels the requirement. Rectification would be correct where a patient disputes an error in their record and requests amendment.
- ✓
Right to access
Why this is correct
HIPAA's patient right to inspect and obtain a copy of their medical records maps directly to the right to access. It lets individuals obtain their own data, distinct from rectification, erasure or portability, satisfying the requirement that records be made available on request.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.