The facility is responsible for safeguarding Personal Health Information when?

• A. Only during business hours
• B. At all times
• C. Only when data is stored electronically
• D. Never

Answer: (B)

Safeguarding Personal Health Information is a continuous obligation. PHI must be protected at all times—whether it’s in paper form or electronic, and whether it’s being created, stored, transmitted, or used. Because PHI is highly sensitive and breaches can happen any time, security measures must be in place around the clock. This includes physical protections (locked rooms, secure disposal), administrative policies (access controls, training, least-privilege access), and technical safeguards (authentication, encryption in transit and at rest). Limiting protection to business hours or to electronic data would leave PHI vulnerable during other states or times, which is why the best answer is that protection is required at all times.