Policies and procedures that control how sensitive data like medical images are stored, accessed, and used.