Which practice correctly describes handling protected health information or other sensitive data?

• A. Copy data to a personal device for convenience.
• B. Verify authorization, disclose only to authorized individuals, minimize exposure, log access, and follow privacy laws.
• C. Share information with colleagues whenever needed to expedite work.
• D. Ignore access logs if data is confidential.

Answer: (B)

Protecting protected health information hinges on controlling who can access it, ensuring disclosures are limited to those with a legitimate need, and keeping a record of who accessed what. The best practice described emphasizes verifying that someone is authorized, sharing only with authorized individuals, minimizing how much data is exposed, logging every access, and complying with privacy laws. This approach enforces least-privilege and need-to-know principles, creates accountability through audit trails, and aligns with legal requirements for safeguarding sensitive data.

Why the other ideas fall short: storing PHI on a personal device moves data outside approved protections and can bypass encryption and organizational policies; sharing with colleagues without confirming authorization undermines privacy controls and accountability; and skipping access logs removes the ability to detect, investigate, and respond to potential breaches.