What protections do brokers follow for protected health information (PHI)?

• A. Share PHI via unsecured email to any staff.
• B. Protect PHI under HIPAA; share only necessary information and use secure channels.
• C. Post PHI publicly to inform clients.
• D. Store PHI only on paper in unlocked drawers.

Answer: (B)

Protecting PHI means handling health information with confidentiality and security. Under HIPAA, brokers and anyone who handles PHI must implement safeguards across administrative, physical, and technical areas and follow the minimum necessary standard: share only the information needed to accomplish a task, not more.

That involves using secure channels for transmission—encrypted email, secure messaging, or approved, access-controlled portals—and restricting access to those with a legitimate business need. Posting PHI publicly or sharing it through unsecured channels would create a breach, and storing PHI in unlocked, unsecured drawers fails to protect it physically.

So, protecting PHI under HIPAA, sharing only what is necessary, and using secure channels is the correct approach.