Which of the following are some common features designed to protect confidentiality of health information contained in patient medical records?

Locks on medical records rooms alone are only one of three required safeguard categories and do not represent a complete confidentiality protection program.

Passwords alone address only the technical safeguard requirement and are insufficient without physical and administrative controls.

Need-to-know rules alone address only the administrative safeguard requirement and must be combined with physical and technical controls.

HIPAA's Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect PHI. Physical safeguards include securing facilities and workstations (locks on records rooms), technical safeguards include access controls like passwords, and administrative safeguards include workforce access management policies (need-to-know rules). All three categories work together as a layered defense to ensure only authorized individuals access patient information.