Which practice best ensures privacy during PHI access controls?

• A. Post a privacy sign without any procedures.
• B. Limit PHI access to only those who need it.
• C. Disable privacy screens to aid readability.
• D. Follow data privacy policy and PHI access controls; comply with HIPAA requirements.

Answer: (D)

Protecting PHI relies on a formal privacy program that combines access controls with policies and regulatory requirements. Following the organization’s data privacy policy and PHI access controls, in line with HIPAA, provides an enforceable framework: it defines who can access PHI, under what circumstances, requires proper authentication, enforces least-privilege and need-to-know principles, and establishes monitoring, auditing, training, and breach response. This comprehensive approach ensures consistent, accountable protection across all staff and systems.

Posting a privacy sign without procedures offers no actual protection or accountability. Limiting access to those who need it is essential, but without a documented policy and HIPAA-aligned safeguards, there’s no standard to enforce, monitor, or train against. Disabling privacy screens increases risk by exposing PHI to bystanders, which undermines privacy at the moment of access. Therefore, the best practice is to follow the data privacy policy and PHI access controls and comply with HIPAA requirements, providing the full, enforceable protection framework.