To protect health information in an e-mail sent to a colleague, which would be a proper security control?

Logical controls is an umbrella category encompassing many technical controls (passwords, firewalls, ACLs) but does not specifically address the confidentiality of data in transit within an email.

Strong authentication verifies the identity of the sender or recipient but does not protect the content of the email itself if intercepted by a third party after transmission.

Encryption transforms plaintext PHI into ciphertext using a cryptographic algorithm, ensuring that even if an email is intercepted in transit or accessed by an unauthorized party, the contents remain confidential and unreadable without the proper decryption key. HHS guidance specifically identifies encryption as an addressable safeguard under the HIPAA Security Rule for protecting ePHI transmitted over open networks.

Least privilege limits user access rights to systems and data but does not protect the content of an email message once it leaves the sender's environment.