Health information exchanges: what must be ensured?

• A. Share information with all staff
• B. Never use secure channels
• C. Share only information necessary with authorized personnel using secure channels and rely on consent and legal requirements
• D. Do not document disclosures

Answer: (C)

When health information is exchanged, privacy and security must guide what is shared, who can see it, and how it’s transmitted. The best approach is to share only the information that is necessary for the legitimate purpose, with personnel who have a true need to know, and to use secure channels to transmit that data. This framework is supported by consent and applicable laws—some disclosures require explicit authorization, while others are permitted or mandated by law or in emergencies. Always keep a record of disclosures to maintain accountability and track who accessed PHI. Sharing information with all staff would violate the need-to-know principle, never using secure channels would expose data to risk, and failing to document disclosures undermines accountability and compliance.