Which practice most directly reduces the risk of unauthorized disclosure of patient data?

• A. Publicly posting access logs.
• B. Relying on staff memory for authentication.
• C. Implementing robust access controls and authentication.
• D. Sharing passwords among staff.

Answer: (C)

Controlling who can access patient data and proving who is using it is the most direct way to prevent unauthorized disclosures. Robust access controls establish who is allowed to view or modify information and enforce those rules consistently. Authentication verifies the person’s identity (for example, via strong passwords, multifactor authentication, or biometrics), while authorization determines what that person is allowed to do once inside the system. Together, they implement the principle of least privilege, meaning each user gets only the access needed for their role. This limits exposure even if a device is compromised or credentials are targeted, and it creates clear audit trails showing who accessed what data and when.

Publicly posting access logs doesn’t prevent access and can even reveal patterns that aid misuse. Relying on staff memory for authentication is unreliable and insecure; passwords can be forgotten, shared, or guessed, undermining protection. Sharing passwords among staff directly defeats accountability and makes it nearly impossible to determine responsibility for any data access or disclosure. By enforcing strong access controls and reliable authentication, the system remains resilient against unauthorized entries and provides traceability, which is essential for detecting and responding to potential breaches.