Question

A healthcare organization's legal team discovers that patient records from a closed clinic have been kept indefinitely on backup tapes, well beyond the 7-year period required by regulation. The chief privacy officer wants to reduce the organization's exposure from holding this excess data. Which practice, if it had been enforced, would MOST directly have prevented this situation?

Accepted Answer

A data retention schedule that mandates disposal of records once their required retention period expires

Answer

A stronger encryption baseline applied to all archived backup tapes

Answer

A data loss prevention (DLP) solution monitoring outbound email for patient identifiers

Answer

Role-based access controls restricting who can read archived patient records