How should essential patient information be stored to minimize risk of exposure?

• A. In secured systems with restricted access and proper PHI protection measures.
• B. On a public server.
• C. In a notebook left in the lobby.
• D. On personal email.

Answer: (A)

Storing essential patient information in secured systems with restricted access and proper PHI protection measures minimizes exposure risk. This approach uses strong access controls, authentication, and authorization so only authorized staff can view or modify sensitive data. It often includes encryption of data at rest and in transit, regular security audits, secure backups, and clear policies that apply the minimum-necessary principle. Together, these safeguards reduce the chances of unauthorized access, data breaches, or accidental disclosure, while still allowing legitimate care and operations.

In contrast, a public server is openly accessible and not appropriate for protecting PHI. A notebook left in the lobby can be seen or stolen, and personal email lacks organizational controls and encryption, increasing risk of exposure and noncompliance.