During internal QA review of PCRs, which practice protects patient privacy?

• A. Discuss the case with staff who are not involved in the case
• B. Remove PHI from the records before sharing
• C. Share case details publicly to improve transparency
• D. Store copies in an accessible shared drive

Answer: (B)

Protecting patient privacy hinges on removing identifying information before sharing data. In internal QA reviews of PCRs, this means de-identifying records so they can be analyzed for quality without exposing who the patients are. Removing protected health information (PHI)—like names, exact dates, addresses, and other identifiers—limits the risk of someone tracing results back to a person. This approach aligns with privacy requirements and allows the QA team to review accuracy, consistency, and process issues safely.

Other options jeopardize privacy or add risk: discussing a case with staff not involved can still expose identifiers or sensitive details; sharing case details publicly makes patient information broadly accessible; storing copies in an accessible shared drive increases the chance of unauthorized access unless everything is de-identified and access is tightly controlled. De-identification before sharing is the most reliable way to protect privacy while enabling effective QA.