How should a broker handle PHI to protect member privacy?

• A. Ignore privacy policies.
• B. Use secure systems, limit access to authorized personnel, and follow privacy regulations and policy.
• C. Share PHI with friends and family without consent.
• D. Store PHI on personal devices.

Answer: (B)

Protecting PHI relies on two pillars: strong data security and strict access controls guided by privacy rules. The best approach is to use secure systems for storing and transmitting PHI, limit access to only authorized personnel who need the information to do their job, and follow privacy regulations and internal policies. This combination implements the least-privilege principle and ensures compliance with laws like HIPAA, reducing the risk of unauthorized disclosures, breaches, and penalties.

Ignoring privacy policies undermines safeguards and invites noncompliance. Sharing PHI with friends or family without consent breaches confidentiality, and storing PHI on personal devices creates significant risk of loss or theft.