Name two compliance areas Phreesia must adhere to when handling PHI.

• A. GDPR and COPPA
• B. FERPA and HIPAA
• C. SOX and GLBA
• D. HIPAA privacy and security; PCI DSS for payment data

Answer: (D)

Handling PHI requires meeting HIPAA requirements, with two core areas in play. The privacy rule governs how PHI may be used and disclosed, ensuring patients’ information isn’t shared inappropriately. The security rule builds on that by demanding safeguards to protect electronic PHI—things like strong access controls, encryption, and ongoing audit trails. When payment data is involved, another standard comes into scope: PCI DSS, which focuses specifically on protecting cardholder data during processing, storage, and transmission. So the best answer combines these two HIPAA components for PHI and the PCI DSS controls for payment data.

Other frameworks don’t fit this context as directly: GDPR and COPPA address different jurisdictions or data types, FERPA covers student records, and SOX/GLBA address other financial or regulatory concerns that aren’t the PHI-focused safeguards needed here.