Which scenario is an example of data leakage?

• A. Encrypting PHI for transmission
• B. Printing PHI for patient care
• C. Accessing PHI within the EMR during a shift
• D. An employee emails patient information to their personal email address

Answer: (D)

Data leakage happens when protected health information is exposed outside the secure, authorized channels and recipients. In this scenario, emailing patient information to a personal email address moves PHI out of the organization's controlled environment and onto a channel and device that aren’t covered by the organization's security controls. Personal email is typically outside the institution’s encryption, monitoring, and access controls, making it easy for the data to be intercepted, misused, or lost—so this constitutes leakage.

The other options describe appropriate protections or routine, authorized access. Encrypting PHI for transmission safeguards data in transit. Printing PHI for patient care can be appropriate within a controlled, secure setting. Accessing PHI within the electronic medical record during a shift is a normal part of providing care when the user has proper authorization and auditing.