CISSP All Domains Practice test 11

Penetration testers with full physical access to our facility have found Personally Identifiable Health Information (PHI) hard copies laying around. Which of our policies are our employees NOT following?