Which statement best describes the HIPAA-compliant data collection and storage measures in Phreesia?

• A. White-listed apps
• B. Role-based access control, encrypted data in transit and at rest, audit logs, secure sign-on, configurable consent capture, and PHI minimization, and data sharing policies
• C. Public posting of data
• D. No data encryption

Answer: (C)

HIPAA requires comprehensive protections around PHI, covering who can access data, how data is transmitted and stored, and how activities are tracked. The best description of Phreesia’s HIPAA-compliant data collection and storage measures includes several key elements together: role-based access control to ensure only the right people can see PHI based on their job; encryption of data in transit and at rest to keep information confidential even if it’s intercepted or stored on servers; audit logs to record and review who accessed or changed PHI; secure sign-on to prevent unauthorized entry; configurable consent capture to properly document patient permissions; PHI minimization to collect only what’s necessary; and clear data sharing policies to govern external data exchanges. This combination directly aligns with HIPAA expectations for safeguarding PHI.

Public posting of data is not acceptable because it would expose sensitive information to the world, violating privacy requirements. No data encryption leaves PHI unprotected and is not compliant. While white-listed apps can be part of a security strategy, they don’t by themselves guarantee the full set of required safeguards like access controls, encryption, logging, consent management, and data-sharing governance.