AHIMA CTR- Cancer Registry Structure & Management

cancer registry

information system designed for the collection, storage, management, and analysis of cancer patient data.

what is the purpose of the cancer registry?

Establish and maintain a cancer incidence reporting system.

Present a data resource for physicians, researchers, and facility staff.

Provide data to assist public health officials and agencies in the planning and evaluation of cancer prevention and cancer control programs.

Cancer registrars are ______________ __________________ who collect cancer data from a variety of sources and report the resulting cancer statistics to various healthcare agencies.

data specialists

the primary responsibility of the cancer registrar is to ensure that

timely, accurate, and complete data is collected and maintained on all types of cancer diagnosed and/or treated within an institution or other defined population.

the cancer registrar works with

physicians, administrators, researchers, and health care planners to support cancer program development, compliance with accrediting organization's reporting standards, and serve as a valuable resource for cancer information.

Cancer registrars capture a complete summary of

a patient's disease from diagnosis to death.

Cancer data may point to environmental risk factors or high-risk behaviors, so preventive measures can be taken to reduce the number of

cancer cases and resulting deaths.

true or false? - Local, state, and national cancer agencies and cancer-control programs also use registry data from defined areas to make important public health decisions that maximize the effectiveness of limited public health funds such as the implementation of screening programs.

true

true or false? - Lifetime follow-up is another important aspect of the cancer registry. The summary, or abstract, is an ongoing account of the cancer patient's history, diagnosis, current status, and outcome of treatment

true

Current patient ___________________ serves as a reminder to physicians and patients to schedule regular clinical examinations and provides accurate survival information.

follow-up

There are two main categories of registries (_____________ and _____________) and some special types for specific anatomic sites or special cancers (for example, pediatric and brain). Several references to hospital and central cancer registries are made throughout this program, so it is important to have a good understanding of what that means.

hospital and central

There are two major types of national cancer registries:

facility-based and population-based registries.

___________________ registries include integrated networks, individual hospitals, freestanding cancer centers, and oncology components within a larger cancer program.

Facility-based

The National Cancer Act of 1971 established the National Cancer Institute's

Surveillance, epidemiology, and End Results program Aka SEER

The primary purpose of a facility-based cancer registry is to capture the cancer experience of that hospital.

In particular, they are charged with identifying all patients diagnosed or treated for cancer at that hospital and collecting specific information about those patients.

The sources of information (or casefinding sources) used to identify these patients are based on any service area where a cancer patient may interact with the facility (inpatient admission, outpatient visit, etc.).

Reports from these service areas that have a cancer-related diagnosis are matched against the cancer registry database to identify new patients who need to be abstracted. The registry may also need to seek information from outside of the facility to ensure that the complete diagnosis and first course of treatment information has been included.

The goals of a facility-based registry include

Quality patient care

Administrative information

Professional education

Clinical research

central cancer registry (CCR): CCRs are most commonly known as population-based registries because they represent a

defined population.

It is possible for a multi-hospital registry to be classified as a "central" registry but not be population-based.

An example of this would be a healthcare system that owns many hospitals and may have multiple hospital registry departments or databases. In this situation, the population cannot be defined.

While a facility-based registry collects all patients seen at their hospital, it can only capture information on patients who choose to be seen at the facility. This includes patients from various cities, counties, and even other states. The hospital cannot define its population. In other words,

the hospital cannot state that they are going to collect every single case within defined cities or counties because a patient in that city may choose to go to a different facility. Therefore, a hospital registry (and these multi-hospital registries) is not considered a population-based registry.

Why is that differentiation important? Because in order to study cancer in a population, registrars have to be confident that every case in the population has been identified. Incidence and mortality rates are based on the number of cases out of the population at risk. Only population-based registries can provide this type of information. For the most part, when seeing or hearing the term "central cancer registry" used in the cancer surveillance community, it is referring to a population-based registry. For consistency in this program, the use of the term central cancer registry refers only to population-based central registries.

Depending on the funding source, population-based registries can be focused on administration, research, or cancer control.

The goals of a populations-based registry are:

Cancer prevention

Early detection

Determination of cancer rates and trends

Patterns of care and outcomes

Research

Evaluation of control efforts

Hospital cancer registries, as the name suggests, generally reside in hospitals. However, this term is often used to describe the cancer registry in any type of facility that is accredited by the

American College of Surgeons Commission on Cancer (ACoS/CoC) as a way of differentiating this type of cancer registry from a central cancer registry.

Most ACoS/CoC facilities are hospitals, but there are freestanding treatment centers that have achieved ACoS/CoC cancer program accreditation.

In these facilities, a cancer registry is a required component.

The focus of the hospital-based cancer registry is on clinical care and hospital administration.

The data is used by administration in making decisions about service and money allocation, by physicians for education and studies, and much, much more. In hospitals with ACoS/CoC-accredited cancer programs, the cancer registry supports the activities of the cancer program and participates in ensuring that the cancer program meets the requirements for accreditation.

There are a variety of reporting sources for cancer data. They are not individual pieces of information about one patient (such as a pathology report), but are treatment centers, hospitals, and physician offices. These physician office practices would be specialists that manage cancer patients such as

dermatology, urology, medical oncology, and radiation oncology. It would not be time or cost effective to require a family physician to report because a patient with cancer would most likely be referred to a specialist.

central cancer registries

also referred to as central registries - are regional or state-level population-based registries that maintain data on all cancer patients within their given geographical area.

many CCR are housed in state health departments; however an increasing number of CCR are located at universities and serve as either designated or bona fide agents of the state for collecting population-based data on all cancer cases occurring in the population they serve

The CCR depends greatly on the cases received from hospital registries. Most, if not all, CCRs actually receive the largest percent of cases from hospital registries, perhaps as high as 80%, because at some point a patient with cancer, or even a history of cancer, is likely to be seen at the hospital for some reason. Most hospital registries have trained cancer registrars who are able to provide a higher quality of data. The hospital carries the burden of collecting the data, reporting it to the CCR and keeping staff trained. Because hospital registries are just one reporting source for the CCR, it takes a lot more effort, money, staff, and resources for the CCR to collect the remaining smaller percentage of cases from all of the other types of reporting sources.

Data reporters in these other reporting sources are usually not cancer registrars.

Many are health record coders, nurses, or clerical staff. The CCR must take on the burden of keeping these data reporters trained in cancer data reporting or must go to the reporting source and collect the information themselves.

If a patient was seen at two hospitals in the state, each hospital would be required to report the patient's case to the CCR. CCRs perform a function called case consolidation, or record linkage, in which the information from both of the patient's cancer reports would be compared and combined into one report containing the most complete and accurate information.

To give you an example of how much case consolidation takes place, in one state, the CCR receives over 70,000 reports of cancer each year. After the duplicate cases have been consolidated, the actual number of new, unique cases of cancer is around 45,000 cases. Because CCR's have so many reporting sources, many of which see the same patients, case consolidation or record linkage is a major function of CCRs. This function requires a manual review of the reports in the database and is the responsibility of highly trained cancer registrars. This ensures that each case of cancer is counted only once in state and national cancer data.

One characteristic that sets a CCR apart from a hospital registry is that a CCR will cover a defined population.

If it is a state CCR, the defined population is the state borders, and, therefore, all residents of that state.

The first true central cancer registry was in Connecticut, which was formed in 1935 with cases dating back to 1935. Massachusetts had a pilot program in 1926.

The defined population is a particular region of the country such as specified counties within a state.

For example, the Atlanta, GA area has a regional CCR that covers the counties surrounding Atlanta. This is in addition to the Georgia state CCR that covers the entire state. The purpose of this is because of the reporting requirements in Georgia to SEER and NPCR.

In comparison to the hospital-based cancer registry, the data collected by the population-based registry serves a wider range of purposes.

Data from population-based registries can be used for monitoring the distribution of cancer among communities, ethnicity, age, and other demographic groups.

Cancer statistics provided by ________________-based cancer registries make it possible for public health administrators to evaluate suspected clusters of cancer within communities or population groups.

population

Cancer research programs benefit greatly from the cancer data collected by population-based cancer registries because an

unbiased group of cases can be selected for cancer studies; studies of association of cancer and other diseases, environments, occupations, or other sources of exposures can be conducted.

Cancer programs in hospital registries accredited by the CoC will report their data directly to the CoC, and send a separate file of data to the CCR.

Central cancer registries send data directly to the Surveillance, Epidemiology and Ends Results program (SEER), National Program of Cancer Registries (NPCR) and the North American Association of Central Cancer Registries (NAACCR).

Because hospital registries report to the central cancer registry, the data reported to SEER, NPCR and NAACCR will include the hospital data.

There is another type of cancer registry: special cancer registry. These are cancer registries established to collect and maintain data on a particular type of cancer. For example

the Central Brain Tumor Registry of the United States (CBTRUS) is a special cancer registry that is committed to providing a resource for gathering and disseminating current epidemiologic data for all primary benign and malignant brain cancer and other central nervous system tumors. Other special cancer registries have been created to collect data on cervical cancer, colorectal cancer, and lung cancer. These special cancer registries often provide educational opportunities and support for those who may suffer from the disease.

Cancer registration is a quantifiable, organized process by which data are systematically collected no matter where a registry is located or their differences in function and purpose. There is a fundamental data set used by all registries that consists of five components

Incidence

Cancer type(s)

Extent of disease

Treatment

Survival

true or false? - Registration begins with casefinding, goes on to abstracting the patient's cancer information, and continues with lifetime (active) follow-up of cancer patients.

true

The goal of cancer data analysis is to

provide useful information to control cancer and improve patient care.

The registry data is used to evaluate critical outcomes and the quality of healthcare.

This evaluation includes assessing treatment patterns, complications, recurrence, and survival.

Registry data may also include

Co-morbidities that can affect the patient's cancer care and survival

Prognostic indicators that may affect the choice of treatment

Healthcare coverage to assess the impact of a person's ability to pay on the care that they receive

Patient eligibility and participation in clinical trials

to maintain the ODS credential, the registrar must complete ________ continuing education (CE) hours every two years.

twenty

Registry data is used to target programs that focus on risk-related behaviors such as sun exposure and tobacco use. The data is also used to identify where and what screening efforts should be employed or enhanced.

Registry data is fundamental to cancer research and the effectiveness of cancer prevention, control or treatment programs.

CoC

Commission on Cancer (data standard setter)

Which organization represents hospital cancer registries and defined the role of the facility registry?

CoC - commission on Cancer

Which of the following organizations represent state or regional central cancer registries?

SEER and NPCR

Hospitals accredited by the CoC are required to report their data to which CoC database?

Hospitals accredited by the CoC are required to report their data to the NCDB (National Cancer Database).

The National Cancer Act was enacted in 1971 and established

SEER

The Cancer Registries Amendment Act

(Public Law 102-515) was enacted in October 1992 and established

NPCR

NAACCR

founded in 1987; its primary role is to represent and serve as a forum for the organization, operation, quality control, and statistical reporting of population-based cancer registries; North American Association of Central Cancer Registries

• Professional organization includes:

• Registries from all 50 U.S. states and 3 territories

• 13 Canadian provinces and territories

• Other major cancer organizations and individuals involved in standard- setting

and cancer registration activities

• Develops and promotes uniform data standards for cancer registration

• Provides education and training

• Certifies population-based registries

• Aggregates and publishes data from central cancer registries

• Promotes the use of cancer surveillance data and systems for cancer control and

epidemiologic research, public health programs, and patient care to reduce the burden of cancer in North America.

North American Association of Central Cancer Registries (NAACCR) Certification

• Track trends in the occurrence of cancer in North America,

• Diagnosed cancer cases reported to a population-based state, provincial or territorial cancer registry where statistics are compiled in a standard format. This enables us to make comparisons across geographical areas and over time.

• In 1997, NAACCR instituted a program that annually reviews member registries for their ability to produce complete, accurate, and timely data.

• NAACCR annually reviews data from member registries to assure the quality, accuracy, and completeness of cancer incidence data based on predetermined objective and independent registry certification criteria.

Registry staff receive a report containing the results of registry certification evaluation for the most recent data year.

what year was SEER established?

1973

what year was NPCR established?

1992 by Congress via the Cancer Registries Amendment Act

Cancer Registries Amendment Act of 1992

Which entity allowed for the expansion of cancer registries and improvement of existing cancer registries and professional development of their personnel.

what year was CoC established?

1922

what year was NCRA established?

1974

NCRA

National Cancer Registrars Association

NCDB

National Cancer Data Base

NPCR

National Program of Cancer Registries

Standards

are rules set by an authority to reflect the organizational data needs of the standard setters, including the need for consistency among groups.

Three organizations were involved in the development of standard codes for describing cancer's topography (or primary site), morphology (cell type]), and staging (extent of tumor spread)

World Health Organization (WHO), American Cancer Society (ACS), American Joint Committee on Cancer (AJCC)

World Health Organization (WHO)

a global institution dedicated to the improvement of human health by monitoring and assessing health trends and providing medical advice to countries

American Cancer Society

nationwide voluntary health organization dedicated to eliminating cancer

American Joint Committee on Cancer (AJCC)

guided the development, implementation, and the use of the TNM cancer staging and prognosis system

This staging is based on size, and extent of tumor invasion. The letters, T, N, and M are used to stage the tumor.

which organizations developed procedures for central registries?

The National Cancer Institute's (NCI) Surveillance, Epidemiology, and End Results (SEER) program

which organization added inducements for population registries to adhere to guidelines?

The national program of cancer registries (NPCR)

which member based organization/group provides training and education, including formal college education?

The National Cancer Registars Association (NCRA)

which organization published the Manual of Tumor Nomenclature and Coding (MOTNAC) in 1951 that later evolved into coding manuals for cancer morphology codes published by the College of American Pathologists (CAP), and eventually into the ICD-O-3 manual published by the WHO that we all use today?

The American Cancer Society (ACS)

The ACS supports cancer prevention and access to care with many programs in the community. They also sponsor research and training activities. The ACS works closely with the many other standard setting groups to assist them in their work.

which organization has guided the development, implementation, and the use of the Tumor, Node, Metastasis (TNM) cancer staging and prognosis system in America since 1959?

The American Joint Committee on Cancer (AJCC)

This is a clinically oriented scheme developed by the AJCC in cooperation with the TNM committee of the Union for International Cancer Control (UICC). It is used worldwide for the prognostic staging of cancers.

true or false?:

The AJCC regularly updates its staging scheme to incorporate advances in prognostic technology.

true-

They want to ensure that the stage groupings continue to have similar outlooks, prognosis, and survivals. AJCC is committed to improving the predictive accuracy of the TNM system. They are also working to make the system accessible and useful to the practicing physician. The CoC accreditations program requires physicians to assign AJCC staging for all sites having defined staging schemes.

true or false?:

The Commission on Cancer (CoC) of the American College of Surgeons (ACoS) was first formed in 1913.

true-

The first committee started the process of outcome analysis of cancer cases based on stage and treatment.

CoC accredited programs are required to maintain a cancer registry that collects the required data items and also performs studies, along with many other requirements.

true or false?:

The North American Association of Central Cancer Registries (NAACCR) was established in 1987 as a membership organization for central cancer registries in the United States and Canada?

true-

This group serves as a forum to resolve problems, establish shared standards, and improve the quality and consistency of central registry data and operations. NAACCR took on the challenge of coordinating standards developed by other groups, developing standard codes and procedures, and evaluating the quality of registry data.

The Uniform Data Standards Work Group (UDSWG) (formerly called the Uniform Data Standards Committee, or UDSC) of NAACCR is the group that compiles coding, editing and data exchange standards. The work of the UDS built on earlier joint efforts of the CoC, SEER, and NCRA to find ways to coordinate disparate codes and data sets. The various groups have agreed that items under consideration for change are reviewed by the UDS. Currently, a refinement of procedures to ensure each organization has been involved in these discussions is underway. The UDS continues to work today on remaining unresolved issues between the various groups, as they each have different needs, goals, and purposes. Apparent persisting inconsistencies in codes often reflect differences in underlying theory. That is, the codes might appear to measure the same thing, but they do not, and they differ in respect to issues important to that organization.

true or false?:

The National Program of Cancer Registries (NPCR) was set in place by the Cancer Registries Amendment Act (Public Law 102-515) enacted by Congress in 1992?

true-

This followed years of individual states forming registries to monitor their cases and allow them to develop programs to meet the needs of their residents. It was then decided that a national program was needed to pull all of this information together. The Center for Disease Control and Prevention (CDC) was authorized to administer this program.

The intent of the federal law was to improve cancer control by assisting the continuation or development of state population-based central registries. The data they collect must conform to uniform standards. NPCR provides grant money and assistance in training and management to the state registries.

which database is a joint effort by the ACS and the ACoS?

The National Cancer Database (NCDB);

The NCDB collects data from computerized hospital cancer registries. They use this information to evaluate cancer trends and in analytic research. They are also able to evaluate differences in care and outcomes across the country. Data submission to the NCDB is required for CoC accredited cancer programs. This merging of national data reinforces the importance of standard code definitions.

true or false?:

The National Cancer Registrars Association (NCRA) is a membership organization for cancer registrars established in 1974.

true!

NCRA takes the lead in professional development of cancer registrars by offering formal college education programs for registrars, and also other types of education and training. NCRA publishes a college-level textbook and other manuals.

NCRA first offered a certification exam for cancer registrars in 1983. After passing the exam, registrars must maintain the credentials by achieving a number of continuing education hours every two years. This ensures that registrars keep their skills and knowledge up to date in a changing environment.

NCRA also offers mechanisms for advocacy. It is important to have a dialogue between registrars and the standard setters to ensure all points of view are taken into consideration before changes are made. The organization also advocates on behalf of members in national legislation, such as acts to provide resources for cancer research and support of continuing education.

true or false?:

The National Cancer Institute's (NCI) Surveillance, Epidemiology, and End Results (SEER) program was established by the National Cancer Act of 1971, with data collection beginning in January 1973.

true-

It is made up of large cities and regions, along with some states. The theory is that the areas selected statistically represented the country as a whole, and therefore conclusions could be made about cancer in America. They try to match the country in race, ethnicity, age, living styles such as suburban and rural, and other factors.

SEER requires its registries to adhere to their data standards. These standards have formed the basis of many central registry data standards today, even if they do not belong to SEER.

SEER also assists registries through audits, training and education, and the publication of manuals. SEER has published registry training manuals and also more advanced publications aimed at experienced registrars.

true or false?:

After the United Nations was established, the World Health Organization (WHO) became the group responsible for publishing disease codes.

true-

They develop the coding used for hospital medical records and in most health facilities, International Classification of Diseases, 10th revision (ICD-10).

This coding system forms the basis for the International Classification of Diseases for Oncology 3rd Edition (ICD-O-3), the worldwide standard for cancer diagnosis coding.

ICD-10 disease codes for cancer are primarily topographical, though special codes that combine topographic and morphologic characteristics of some cancers have been in use for a number of years. The main differences between the two systems, ICD-10 and ICD-O, are in the codes for leukemias and lymphomas.

The codes in ICD-10 combine topography and morphology for these diseases.

The ICD-O manuals provide registries with topography codes similar to the ICD codes. They also provide morphology codes developed from codes originally published by the American Cancer Society (ACS).

A registry position description should include requirements on the following functions

Cancer program management

Data management

Data retention and retrieval

Personnel administration

Reporting to a central cancer registry

Registry statistics

Legal and ethical perspectives

Quality assurance

Data privacy, security, and confidentiality

Diagnosis; stage; and treatment coding, classifying, and indexing

Educational or technical qualifications including knowledge of the disease process, diagnostic methods and procedures, composition of the health record, data interpretation, and statistical and analytical skills

Work schedules

Interactions with medical and administrative staff

Intradepartmental and interdepartmental relationships

Required memberships, if any

Physical requirement, if applicable

What is the monitoring component for the health facility's cancer program?

cancer registry

What did The National Cancer Act of 1971, often referred to as the "War on Cancer," establish?

National Cancer Institutes, Surveillance, Epidemiology, End Results program (SEER)

From where does the NCI SEER Program receive population-based cancer data?

selected geographical areas

National reporting rules and requirements ensure that the data collected, regardless of where it is collected, is ________.

standardized

Which of the following does NOT describe a central cancer registry?

A-Identifies all individuals with a diagnosis of cancer residing in the defined population B-Is considered a population-based registry C-Uses data to support the requirements of the Commission on Cancer D-Uses reporting sources such as physician offices and pathology laboratories to identify cases E-Uses data to monitor the distribution of cancer among communities, ethnicity, age and other demographic groups

C- Uses data to support the requirements of the Commission on Cancer

From where do hospital cancer registrars obtain information about a case for the cancer registry abstract? The hospital's medical record, The free-standing radiation center across town, Staff and non-staff physician offices, All of the above as necessary for case completion

All of the above as necessary for case completion

What is the main purpose of a cancer registry? Provide information to prevent and control cancer and improve care. Record the number of visits each cancer patient makes to the facility for care. Provide staff for the cancer program. None of the above.

Provide information to prevent and control cancer and improve care.

What is the first step in determining staffing, office space and equipment needs?

Establish the caseload.

Each standard setting organization represents varying registry interests. What does the CoC represent? A-State registries B-Hospital registries C-National registries A and B

Hospital registries

Cancer registrars who are certified are required to acquire _________ continuing education (CE) hours every ________ year(s)

20, 2

The American Cancer Society estimates that about ________ new cases of cancer will be diagnosed in 2022.

1.9 million

Which organization acts as the clearing house for changes to data standards and standardizes the requirements for all standard setting organizations?NCRA CoC NAACCR SEER NPCR

NAACCR

Which one of the following would accurately describe the Commission on Cancer? A-Requires that a cancer registry be a mandatory component of their accredited program B-Collects data from selected states and geographical areas C-Charged with establishing central cancer registries in states where they did not previously exist D-Oversees the Uniform Data Standards Work Group that promotes standardized data transmission

A-Requires that a cancer registry be a mandatory component of their accredited program.

The American Cancer Society estimates that one of every ________ deaths in America is from cancer.

4

The Policy and Procedure Manual ________.

promotes consistency serves as a training tool contains the reportable list All of the above

all of the above- promotes consistency serves as a training tool contains the reportable list

Which of the following does not accurately describe specialty cancer registries? Participation in a specialty cancer registry is mandatory Specialty cancer registries can be site-specific Specialty cancer registries many register entire families including those without cancer A specialty cancer registry can be institutional, national or even internationally based.

Participation in a specialty cancer registry is mandatory

What can a Time-and Motion Study help determine? The registry's case load The amount of equipment necessary Staffing needs and productivity requirements All of the above

Staffing needs and productivity requirements

Patients expect complete privacy and security of all their health information, but the complexity and reality of the modern healthcare system complicates this expectation due to some of the following

Many different healthcare providers may need access to patient information to provide quality care.

Payment is a complex network of health insurance claims, authorizations, and benefits analysis coordination.

Medical referrals require information, and public health programs use collected health data to identify disease trends, evaluate treatment outcomes, and assure the quality of healthcare operations.

the objectives of "Administrative Simplification" of HIPAA

Protect and enhance the rights of consumers by providing people access to their health information while controlling inappropriate use of that information

Improve quality of healthcare by restoring trust in the healthcare system among: Consumers, Healthcare professionals, Multitudes of organizations and individuals committed to the delivery of care

Increase efficiency and effectiveness of healthcare delivery by creating a national framework for health privacy protection that builds on efforts by: States, Health systems, Individual organizations, Individuals

Identifiable Health Information

protected health information under HIPAA;

Condition of the patient of the patient

Treatment of the patient

Billing

Individually Identifiable information

protected health information under HIPAA;

Name

Identifiers

Address

Social Security number

Phone number

Information that permits reasonable deduction to the patient's identity

additionally HIPAA protects information that can link the patient's identity with other health information. An example is

the linking of a database of patients from a clinic to a database with prescription drug information that could lead to knowledge of the patient's condition such as a diagnosis of a sexually transmitted disease.

Privacy protections are aimed at meeting confidentiality expectations for data provided or accumulated from health-related information given by a patient for the purpose of diagnosing and treating their health problems. Individuals have the right to deny any and all use of their confidential information; however, this denial would result in no diagnosis or treatment. HIPAA provides consistent requirements that do not allow the disclosure of individually identifiable information so that a patient can expect their confidential information to remain private and used only for their healthcare.

Healthcare providers must have a signed authorization from the patient to permit access to, or disclosure of, any identifiable information for any purpose beyond treatment, payment, and healthcare operations. There are disclosures for which an authorization is not required such as, requirements of law and public health activities. All states have laws that require healthcare facilities to report cancer to the state cancer registry or department of health, which, in turn, uses the data for public health activities. Patient authorization is not required for the cancer registry to report data to the state central cancer registry.

Security encompasses all procedures and actions taken to protect confidential information. An important component of the organization's security management plan is formal operational policies and procedures to provide security instructions to all applicable personnel. A formal process must be established to report, investigate and resolve incidents involved in a breach of confidentiality.

Security ranges from delineating who has access to confidential information and the actual physical security of confidential information. Security includes, but is not limited to, a disaster plan, computer passwords, and locks on doors and files.