A county assessor’s office wants technical controls when staff paste medical record numbers into AI prompts. Which security control best fits?
Select an answer to reveal the explanation.
Short Explanation
You can think of DLP as a metal detector at the prompt door: it alerts you when a medical record number is about to enter an AI chat. Warnings or blocks help you catch mistakes before they happen, rather than relying on hope.
Full Explanation
When county assessor staff paste medical record numbers into AI prompts, written policy alone may miss real-time mistakes. DLP that detects sensitive identifiers in prompts and warns or blocks submission provides an active control aligned with municipal privacy and security duties. Pattern detection for MRNs and similar tokens can stop accidental exfiltration before information reaches an external model endpoint from a workstation. Turning off prompt monitoring removes detection and weakens incident response; relying on staff to avoid entering identifiers does not prevent mistakes. Whitelisting medical record numbers as ordinary spreadsheet text disables signals DLP needs and normalizes unsafe pasting. Forwarding every flagged prompt to a public mailing list re-exposes sensitive content and creates a new breach channel. Exam caveat: DLP can produce false positives and be bypassed with obfuscation or screenshots, so it complements rather than replaces training, approved private tools, and least-privilege access to medical-adjacent records. Practical check: submit a synthetic MRN in a prompt on a managed workstation, confirm warning or blocking and secure alert handling, tune detectors with privacy stakeholders to reduce noise, and document exceptions without sending raw MRNs to public AI services.