Which of the following is a proper safeguard for Protected Health Information (PHI)?

• A. Access controls, encryption, secure storage, and limiting disclosures to necessary parties.
• B. Public posting of PHI on a bulletin board.
• C. Sharing PHI with all employees without need.
• D. Storing PHI in unencrypted spreadsheets.

Answer: (A)

Protecting PHI relies on layering safeguards that address who can access data, how data is stored, and how it is shared. The best approach combines administrative, physical, and technical measures: access controls so only authorized personnel can view PHI; encryption to protect data at rest and in transit; secure storage with restricted physical access; and a commitment to the minimum necessary standard so disclosures are limited to what is required for the task. This combination directly reduces the risk of exposure and aligns with HIPAA’s requirements for safeguarding PHI.

Publicly posting PHI would expose private information and violate confidentiality. Sharing PHI with all employees without a legitimate need disregards the minimum necessary principle and increases risk. Storing PHI in unencrypted spreadsheets leaves sensitive data vulnerable to breaches and is not compliant.