How should confidential information be handled according to privacy and security guidelines?

• A. It should be accessed on a need-to-know basis, stored securely, and shared only with authorized persons.
• B. It can be accessed by anyone within the department.
• C. It should be posted on the bulletin board for transparency.
• D. It should be stored on personal devices for convenience.

Answer: (A)

Confidential information should be treated with strict access controls and strong protection. The idea is to give access only to people who truly need it to do their jobs, and to secure the data so it can only be viewed or shared by those authorized. This principle of least privilege helps prevent accidental or intentional disclosures and supports privacy and security requirements. In practice, this means using proper authentication and authorization, storing data securely (often with encryption), and sharing only through approved, authorized channels. That’s why accessing on a need-to-know basis, storing securely, and sharing only with authorized persons is the best approach.

Other options undermine privacy: letting anyone in the department access confidential information removes necessary protections; posting it publicly defeats confidentiality entirely; and storing it on personal devices creates unmanaged risk and possible loss or theft.