Which action is NOT consistent with protecting PHI in electronic records?

• A. Use secure access controls.
• B. Share PHI with unauthorized individuals.
• C. Log off when finished.
• D. Encrypt data where possible.

Answer: (B)

Protecting PHI in electronic records relies on strict access control, session security, and data protection. Sharing PHI with unauthorized individuals directly violates confidentiality and the obligations to keep patient information private. It creates a real risk of exposure and can breach laws and organizational policies, leading to harm to patients and potential penalties. The other actions support protection: secure access controls limit who can view PHI to those with a legitimate need to know; logging off when finished prevents others from accessing your active session; and encryption protects data both at rest and in transit, reducing harm if a device or network is compromised. If PHI must be shared, it should only be through approved, secure channels and with proper authorization and a minimal necessary approach.