How should sensitive patient information be stored to minimize risk of breach?

How should sensitive patient information be stored to minimize risk of breach?

• A. Publicly accessible cloud storage with minimal encryption
• B. Archive in unencrypted USB drives
• C. Use access controls, encryption, secure storage, regular audits, and minimal necessary data retention
• D. Share freely among staff with password-protected accounts

Answer: (C)

Protecting patient information relies on layered safeguards that limit who can access data, ensure it stays unreadable if it’s exposed, and minimize the amount of data kept. The best approach uses strong access controls so only authorized individuals can view PHI, encryption to protect data at rest and in transit, secure storage to prevent physical or configuration-based leaks, regular audits to detect and respond to unusual activity, and keeping only the minimum necessary data for each purpose. Together, these measures reduce both the likelihood and the impact of a breach and align with established privacy and security practices. In contrast, publicly accessible cloud storage with little encryption leaves sensitive information exposed to anyone, unencrypted USB drives can be lost or stolen, and sharing accounts or data freely among staff undermines accountability and increases risk.

Protecting patient information relies on layered safeguards that limit who can access data, ensure it stays unreadable if it’s exposed, and minimize the amount of data kept. The best approach uses strong access controls so only authorized individuals can view PHI, encryption to protect data at rest and in transit, secure storage to prevent physical or configuration-based leaks, regular audits to detect and respond to unusual activity, and keeping only the minimum necessary data for each purpose. Together, these measures reduce both the likelihood and the impact of a breach and align with established privacy and security practices.

In contrast, publicly accessible cloud storage with little encryption leaves sensitive information exposed to anyone, unencrypted USB drives can be lost or stolen, and sharing accounts or data freely among staff undermines accountability and increases risk.