Which policy governs how staff use and protect patient information on electronic devices?

• A. Acceptable Use Policy for IT systems only.
• B. Data privacy policy and PHI access controls; follow HIPAA requirements.
• C. Employee privacy guidelines only.
• D. No formal policy is required for PHI.

Answer: (B)

Protecting patient information on electronic devices relies on a formal data privacy framework that sets how PHI is accessed and safeguarded, aligned with HIPAA. This approach establishes who can view or use patient data, enforces least-privilege access with strong authentication, encryption, device management, and clear breach response—covering both privacy and security requirements for electronic PHI. That combination is why this option is the best match: it explicitly addresses data privacy, controls on PHI access, and the legal standards of HIPAA. The other choices are too narrow or incorrect: focusing only on an acceptable-use policy misses the broader privacy protections for PHI; emphasizing employee privacy alone ignores patient data security; and saying no formal policy is required contradicts HIPAA requirements.