Which of the following is NOT a best practice for privacy and security?

Keeping fax machines in restricted areas is a recognized physical safeguard that limits unauthorized access to incoming PHI transmissions.

Keeping PHI documents out of sight is a standard workstation security practice required under HIPAA's physical safeguard provisions.

HIPAA's Privacy Rule requires covered entities to implement reasonable safeguards to protect PHI, including proper disposal methods that render the information unreadable or indecipherable. The HHS guidance on disposal specifically states that PHI must be shredded, burned, pulped, or otherwise rendered unrecoverable rather than simply discarded. Leaving PHI documents intact and not shredding them creates a significant risk of unauthorized disclosure and constitutes a failure of required safeguards.

Keeping medical records rooms locked is a required physical safeguard under HIPAA to prevent unauthorized access to PHI stored in those spaces.