Which practice aligns with proper handling of PHI during enrollment conversations?

• A. Share PHI with marketing partners without consent.
• B. Store PHI on personal devices without encryption.
• C. Use secure communications, limit data collection to what’s necessary, and obtain consent when required.
• D. Email PHI in plain text to the client.

Answer: (C)

Protecting PHI during enrollment means using secure communications, collecting only what’s necessary, and obtaining consent when required. Use encrypted channels or secure portals for sharing information and verify the recipient’s identity before sending anything containing PHI. Only gather data that is essential to complete enrollment and eligibility, avoiding extra details that aren’t needed. If PHI will be used or disclosed beyond what’s permitted, obtain explicit consent in line with policy and applicable laws. This approach minimizes risk and keeps information protected.

Sharing PHI with marketing partners without consent breaches confidentiality. Storing PHI on personal devices without encryption creates vulnerabilities. Emailing PHI in plain text exposes sensitive data to interception. These practices compromise privacy and security, which is why they aren’t appropriate.