A debug export tool used by support engineers dumps full date-of-birth values and medical notes from tickets by default. What should be built into that operational tooling?
Select an answer to reveal the explanation.
Short Explanation
Support tools are still front doors. Mask DOB and medical notes by default in debug exports — convenience dumps are how PHI walks out of the building.
Full Explanation
Sanitization must extend to operational and support tooling, not only primary end-user UX. A debug export used by support engineers should default to redacting or omitting date-of-birth values and medical notes unless a separately authorized break-glass path is used and audited. Municipal support tools are still front doors to PHI and PII; convenience dumps are how sensitive fields leave the building during routine triage. Default-deny on sensitive columns keeps day-to-day ticket work usable without normalizing full clinical or identity disclosure.
One-click export of unredacted PHI to personal email for offline triage fails because personal mailboxes are uncontrolled stores outside city retention and access reviews. Automatic replication of exports into a public status page fails conceptually by broadcasting resident health and identity data to anyone who can load the page. Removing all authentication on the export API to speed after-hours debugging fails because it turns the export endpoint into an anonymous exfiltration channel.
Exam caveat: break-glass access should be time-bounded, ticketed, and logged; a permanent "show everything" toggle recreates the original risk under a different label. Operational check: run a default export on a synthetic ticket, confirm DOB and medical notes are masked, verify break-glass requires extra authorization with CloudTrail or application audit events, and re-test after each tooling release.