What practice best supports accountability when accessing patient data in electronic health records?

• A. Limit access to authorized users.
• B. Share access broadly.
• C. Access records without documenting.
• D. Always document who accessed the record and when.

Answer: (D)

Keeping track of who views patient data is essential for accountability in electronic health records. The strongest practice is to always document who accessed a record and when, because this creates a verifiable audit trail. This trail allows supervisors, privacy officers, and investigators to determine exactly what happened, establish responsibility, and ensure compliance with privacy and security requirements. It also helps deter inappropriate access because actions leave a trace that can be reviewed.

Limiting access to authorized users is important, but without a record of who accessed what, when, there's no evidence to support accountability and traceability. Sharing access broadly directly undermines privacy and makes it impossible to determine responsibility. Accessing records without documenting eliminates the only mechanism to prove who did what, when, and for what purpose.