A hospital configures clinical notes so every intern account can edit any record without need-to-know controls. Which processing principle is most directly undermined?
Select an answer to reveal the explanation.
Short Explanation
Clinical notes are not a shared whiteboard for every badge in the building. Integrity and confidentiality mean appropriate security—need-to-know access, not open edit rights for every intern login. Wide-open permissions invite unauthorised changes and disclosures.
Full Explanation
Integrity and confidentiality require processing personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Configuring clinical notes so every intern account can edit any record without need-to-know controls most directly undermines that principle: broad write access enables tampering, snooping, and integrity failures in highly sensitive health data.
Purpose limitation alone is not the lead failure mode, and intern accounts clearly process personal data. Storage limitation mainly concerns how long data are kept, not open edit rights for all interns. Accuracy does not require every intern to rewrite notes nightly; uncontrolled editing more often threatens accuracy and integrity.
Exam caveat: need-to-know and least privilege are integrity/confidentiality operationalisations. Operational check: role-based access, break-glass elevation with logging, immutable audit trails, and periodic access reviews for clinical systems. Public hospitals and civic health services should protect patient notes as a dignity and safety duty, recording why open-edit-for-all was rejected as incompatible with clinical trust.