Which of the following is a common data privacy risk in Care Everywhere?

• A. Over-encryption making data inaccessible.
• B. Excessive auditing causing privacy fatigue.
• C. Patients storing data locally on devices.
• D. Misconfigured access controls leading to unintended PHI exposure or data shared without proper consent.

Answer: (D)

Controlling who can access and sharePHI is essential in Care Everywhere. When access controls are misconfigured, people may see or receive information they shouldn’t, and data can be shared without proper patient consent, creating real privacy and regulatory risks. This kind of misconfiguration often happens when default permissions aren’t updated for different roles, or when changes in one system aren’t propagated across the network, allowing unintended exposure across care settings.

Encryption is a strong privacy safeguard; over-encryption that makes data unusable isn’t a typical privacy exposure risk in daily practice, and auditing—while potentially burdensome if excessive—serves to protect privacy rather than create a direct exposure. Data stored locally on patient devices can pose risks, but the most consistent, systemic privacy risk in Care Everywhere is improper access controls that fail to enforce who may view or share PHI and with whom.