A public-health clinic laptop with resident vaccination records is left unlocked on a picnic table during an outreach event. Which security pillar is primarily violated?

Confidentiality protects information from unauthorized disclosure. An unlocked public-health clinic laptop holding resident vaccination records on a picnic table primarily threatens confidentiality because passersby, other attendees, or opportunistic actors can view or copy sensitive personal health data without authorization. In outreach settings, physical exposure of screens and files is a classic confidentiality failure even before malware or network compromise enters the picture.

Availability is not the primary pillar here: possible outdoor battery drain may affect uptime later, but the immediate harm illustrated is unauthorized viewing of health data, not loss of service for authorized clinicians. Integrity is likewise secondary; sunlight does not meaningfully 'always corrupt checksums,' and the scenario does not describe unauthorized modification of records. Nonrepudiation concerns proving who performed an action; an unlocked laptop does not principally erase attribution of file opens the way confidentiality exposure does.

Exam caveat: Map the scenario to the CIA triad (plus related concepts) by asking what was lost first—secrecy, trustworthiness of data, or usable access. Picnic-table and shoulder-surfing vignettes almost always point to confidentiality.

Operational check: Enforce full-disk encryption, auto-lock, privacy screens for field clinics, minimize local PHI copies, require checked-out device custody logs, and train outreach staff never to leave authenticated sessions unattended in public spaces.