What are best practices for password security on clinic computers used by reception staff?

• A. Use strong unique passwords, enable logout on inactivity, and restrict PHI access.
• B. Leave computers unlocked when away.
• C. Use simple passwords and share them with colleagues.
• D. Disable logout on inactivity.

Answer: (A)

Focusing on proper password practices and session controls protects patient information and keeps clinic systems secure when reception staff are handling sensitive data. Using strong, unique passwords makes it much harder for someone to guess or crack a login, especially in a busy reception area where passwords should not be predictable or shared. Enabling logout or automatic screen lock after inactivity ensures that if a staff member steps away, the computer doesn’t stay accessible, preventing unauthorized viewing of protected health information. Also restricting PHI access to those who need it follows the least-privilege principle, reducing the potential exposure of data if an account is compromised.

The other options present clear risks: leaving computers unlocked invites anyone nearby to view PHI; simple passwords that are shared defeat accountability and are easy to compromise; and disabling logout on inactivity keeps sessions open, increasing the chance of unauthorized access. Implementing strong, unique passwords, automatic logout/lock on inactivity, and restricted data access addresses these risks directly and supports patient privacy and regulatory compliance. For additional protection, consider multi-factor authentication and automatic screen locking after a short period of inactivity.