Which is a data privacy and security best practice in community health programs?

• A. Limit access to PHI and de-identify data when possible
• B. Share PHI publicly to increase transparency
• C. Store data unencrypted on personal devices
• D. Allow staff to access all data without training

Answer: (A)

Controlling who can see health information and reducing how much identifiable data is used are fundamental for protecting privacy in community health programs. Limiting access to protected health information to those who need it (the least privilege principle) minimizes the risk if a breach occurs. De-identifying data when possible removes or masks identifiers so data can be used for improvement and research without exposing individuals, allowing valuable insights while safeguarding privacy. These practices support legal and ethical obligations and enable responsible data use.

Publicly sharing health information violates privacy protections. Storing data unencrypted on personal devices creates clear security vulnerabilities. Letting staff access all data without proper training undermines safeguards and increases the chance of misuse or leakage.