Why is it important to avoid using personal devices for storing patient PHI?

• A. Cloud storage is inherently secure
• B. Personal devices lack the necessary encryption protocols
• C. Personal devices are cheaper
• D. All PHI should be stored on devices

Answer: (B)

PHI must be protected with strong technical safeguards, and personal devices often don’t come with those protections in place. Personal devices can be missing reliable encryption, robust authentication, up-to-date security patches, and enterprise-level controls like remote wipe and audit logging. If such a device is lost, stolen, or infected with malware, PHI can be exposed to unauthorized people, and the organization may struggle to monitor access or respond quickly. Even if cloud storage or other solutions are used, security depends on proper configuration and policies, not on the fact that a device is personal. The focus is on encryption and enforceable safeguards; other statements don’t address these risks and aren’t reliable protection for PHI.