Which of the following represents an example of an access control for PII and PHI?

Locking all devices with a password or key exemplifies a significant access control measure for Personally Identifiable Information (PII) and Protected Health Information (PHI). This practice serves as a frontline defense mechanism to prevent unauthorized access to sensitive data. By ensuring that only authenticated and authorized users can access devices containing such information, the risk of data breaches and privacy violations is significantly reduced.

This control is particularly important in environments where individuals may inadvertently leave devices unattended, as it maintains the confidentiality of the data stored on those devices. It also reinforces the principle of least privilege, allowing only those with valid credentials access to sensitive information, which is a foundation of effective data privacy and security policies.