A municipal health clinic app stores appointment notes that qualify as PHI. Ordinary public-works service tickets in another module do not. What should the team recognize when securing the clinic notes?
Select an answer to reveal the explanation.
Short Explanation
Clinic notes are not the same animal as a pothole ticket — PHI wears a brighter hazard vest. Classify it higher and tighten access, logging, and retention even if both modules live in one AWS account.
Full Explanation
Protected health information requires stricter controls than ordinary municipal service data: tighter authorization, careful logging, and retention aligned to health-data rules. Shared account residency or JSON shape does not equalize sensitivity. Encryption at rest alone does not remove developer responsibility for PHI handling. Unauthenticated SNS fan-out would expose PHI.