What security practice reduces risk when using Phreesia tablets with patient data?

• A. Public sharing of screens and no authentication
• B. Using personal devices without encryption
• C. Storing data only on local memory with no network
• D. Role-based access control, device screen lock, and encryption for data in transit and at rest

Answer: (D)

Protecting patient data on Phreesia tablets hinges on restricting who can access information, securing the device itself, and protecting the data as it moves and sits on the device. Implementing role-based access control ensures each user can only see and act on what their role requires, enforcing the principle of least privilege. A device screen lock adds a practical barrier against casual or opportunistic access if the tablet is left unattended. Encryption for data in transit and at rest means information is unreadable even if the device is lost, stolen, or intercepted during transmission, so patient data remains protected both while stored locally and when it’s being sent to or from the system. Together, these practices reduce exposure risk and support compliance with patient privacy standards.

Other options would leave gaps in protection. Public sharing of screens and no authentication would expose sensitive data to anyone nearby. Using personal devices without encryption introduces risk if the device is compromised. Storing data only on local memory with no network could still be vulnerable if the device is accessed without proper protections and would lack safeguards for data in transit.