A hospital has three data classification levels: shareable without restrictions, shareable with restrictions, and internal use only. Which of the following BEST demonstrates adhering to principles of

Posting an employee code of conduct labeled 'shareable with restrictions' in a public waiting room violates the classification policy, as a restricted document should not be freely visible to non-employees or the general public.

An employee code of conduct is generally an internal policy document that could reasonably be shared in restricted contexts, but labeling it 'internal use only' and then posting it in a public waiting room contradicts the classification by exposing it to unauthorized viewers.

A memo about a newly discovered data breach is highly sensitive operational security information that could cause harm if disclosed externally, so classifying it as 'internal use only' is appropriate. Posting it on an internal staff bulletin board (accessible only to employees) correctly aligns the data's sensitivity level with its access controls. This demonstrates proper classification by restricting a sensitive document to only those within the organization who need to know.

Electronic health records containing PII are among the most sensitive data types and should be classified at the highest restriction level; marking EHR/PII data as anything less than the most restrictive classification (e.g., 'shareable without restrictions') would violate data classification principles and regulatory requirements like HIPAA.