A public-health GenAI pilot documents HIPAA-adjacent handling controls even when notes are de-identified. What compliance approach is this?
Select an answer to reveal the explanation.
Short Explanation
Health data stays sensitive even when someone says 'we de-identified it.' Document the controls like locking the clinic door—marketing blogs and public demos are not a compliance plan.
Full Explanation
Addressing health-sector compliance expectations for civic AI is the correct approach when a public-health GenAI pilot documents HIPAA-adjacent handling controls even when notes are de-identified. That works because health-related civic AI often sits near protected health information pathways; de-identification is fallible, re-identification risk remains, and public-health programs are judged against health-sector expectations—not just generic IT hygiene. Documenting controls for access, minimization, retention, vendor processing, and incident response shows the pilot was designed under those expectations rather than hoping a label ('de-identified') ends the analysis.
Uploading raw clinic notes to a public demo site to speed testing fails by concept and is a severe confidentiality breach—speed never justifies public exposure of clinic content. Skipping documentation because de-identification is assumed perfect fails by concept: assumptions are not controls, and perfect de-identification cannot be presumed without method, review, and residual-risk analysis. Relying only on the vendor's blog post about 'HIPAA ready' marketing fails by concept—marketing copy is not a city-owned compliance determination or BAA/control evidence.
Exam caveat: 'HIPAA-adjacent' civic contexts still need counsel-informed classification; documentation does not replace required agreements when PHI is truly in scope. Keep public-health GenAI pilot framing. Operational check: classify data and flows with privacy/legal; document de-identification method and residual risk; enforce least privilege and logging; ban public demo uploads of clinic content; and retain a city-owned control package rather than vendor blog posts alone.