How is consent for data sharing captured in Phreesia, and what controls restrict access to PHI?

• A. Consent is captured via forms; access controls restrict PHI by user roles; release of information is logged and requires authorization.
• B. Consent is granted automatically.
• C. Access controls are not needed.
• D. Release of information happens without any authorization.

Answer: (A)

Consent for data sharing in Phreesia is captured through patient-facing forms that document the patient’s permission preferences and store them in the patient’s record. Access to PHI is restricted using role-based access controls, so only users with appropriate roles can view or modify PHI. When information is released, it requires formal authorization and is logged, recording who requested the release, what data was shared, and when. This creates an auditable trail and supports privacy compliance.

Automatic consent would ignore patient choice, and skipping access controls or releasing information without authorization would undermine security and violate policy.