Learn how to spot a record that's protected by extra rules — like the ones for health, student, payment, or financial records — and how to find the right person to ask before you move, copy, or share it.
Before you move a sensitive record, check four things: the right person, a real reason, a safe place, and a quick note of what you did.
Last reviewed 2026-06-17 by the IT Lunchroom Editorial Team. General guidance, not professional security or legal advice.
I can spot when a record needs extra care, and find the right person to ask before I move it.
You'll walk away able to notice when a record needs extra care, and to find the right person to ask before you act, instead of treating every file the same way.
Some records come with extra rules — a law or a contract says they have to be handled a certain way, with limits on who can see them, why, where they're kept, and a note of when they're used. The common ones are health records, student school records, payment card numbers, and people's financial details. Each is covered by its own rule that protects that kind of record. Treat any of them as needing more care than ordinary day-to-day files.
Before you move a record, ask who it's about and what it describes — that tells you which rule covers it. Health or treatment details fall under the rules for health records. A student's school record falls under the rules for student records. A payment card number falls under the rules for payment records. A customer's bank or account details fall under the rules for financial records. Naming what kind of record it is tells you it needs extra care. And whichever kind it is, the same four checks apply: the right person, a real reason, a safe place to keep it, and a quick note of what you did.
Most of these problems are honest mistakes, not someone trying to do harm: a person copies a record onto their own drive, emails a spreadsheet to the wrong group, or drops it into a handy app that was never meant for it. The fix is simple — slow down right when you're about to move, copy, or share it, and check first that it's going somewhere safe and that the person in charge is okay with it.
Pause when a record names a patient, a student, a customer, or an account holder, or when it has health details, grades, card numbers, or bank details in it, or when it sits in a place marked private or confidential. And if someone asks you to move that kind of record into email, onto a personal phone or laptop, into an app it doesn't belong in, or out to someone outside the company, that's a strong sign to check before you go any further.
Check four things before a protected record moves: the right person (someone who's actually allowed to handle it for this), the right reason (a real work reason, not just curiosity), the right place (a system that's meant for it, not someone's personal drive or a random app), and a note of what happened (a quick record that it was opened or sent). If any of those four is unclear, stop and ask whoever's in charge of the record before you do anything.
Say a coworker asks you to email a list of customer account numbers to an outside company. Those are financial details, so they fall under the rules that protect that kind of record. Run the four checks: is this person actually allowed to do this, is there a real reason, is email a safe place for it, and will there be a note that it was sent? Email isn't safe for that, and you haven't confirmed the outside company, so it fails the check. You stop, find whoever's in charge of the record, and let them send it the safe way.
Practice lets you sort sample records into the kind they probably are, and rehearse finding the right person to ask before you handle anything real.
Write a short note for yourself that names the kind of record, the rule it might fall under, who's in charge of it, and where you'd check before acting — without copying any of the real details from the record.
The right person, a real reason, a safe place, and a note of what you did. The four checks come down to: are you allowed, is there a real reason, is it a safe place, and is there a note of what happened — not whether it's urgent or who asked.
The rules that protect student records. Student school records fall under their own rule, which is why naming what kind of record it is tells you it needs extra care.
Stop and ask whoever's in charge of the record before acting. When you're not sure what kind of record it is or who handles it, checking with the person in charge first heads off the most common mix-ups.
Stop, leave the record where it already lives, and ask whoever's in charge of it whether it can move at all — and if so, where it should go. Patient details fall under the rules that protect health records, so check with the person in charge, and make sure it's going somewhere safe, before it moves anywhere.
Write a short note naming the kind of record, the rule it likely falls under, who's in charge of it, and where you checked — with none of the record's actual contents in it. A good note shows what you decided and how you handled it, while keeping the sensitive details out of it entirely.
Do the hands-on version of this lesson, then create a free account to save your progress. Finish a whole track and you earn a shareable certificate you can add to a résumé or job application. No payment, no catch.
We use cookies for basic analytics to improve these free lessons. See our Privacy Policy.