Which action is least aligned with data security best practices for EHR use?

• A. Store patient identifiers in an unencrypted, easily accessible location for convenience.
• B. Implement role-based access controls and encryption.
• C. Maintain daily local backups.
• D. Require vendor compliance with HIPAA.

Answer: (D)

Protecting patient data means keeping PHI confidential, restricting access to those who need it, encrypting data, and ensuring reliable backups and third-party safeguards. Storing patient identifiers in an unencrypted, easily accessible location directly undermines confidentiality. Even if it seems convenient, that practice makes PHI vulnerable to exposure or misuse, bypassing the protections encryption and access controls are meant to provide.

In contrast, implementing role-based access controls and encryption directly limits who can view data and protects it when stored or transmitted. Maintaining daily local backups supports data availability and integrity in case of loss or corruption. Requiring vendor compliance with HIPAA ensures third-party handlers uphold the same protective standards, reducing risk across the entire data ecosystem.