A public hospital district compares deployment options for a PHI-heavy triage assistant and a non-PHI drafting helper. Which deployment approach best matches governance needs?
Select an answer to reveal the explanation.
Short Explanation
Think of PHI like sealed medical files that stay in a locked clinic room—on-prem or tightly controlled inference fits. Non-PHI drafting can often use a cloud GenAI desk in the hallway if policy allows. Matching deployment to data sensitivity is the governance move.
Full Explanation
A public hospital district comparing deployment options for a PHI-heavy triage assistant and a non-PHI drafting helper should prefer on-prem or tightly controlled inference for PHI-heavy triage and allow cloud GenAI for approved non-PHI drafting. Risk-based deployment matches controls to data classification rather than applying one blunt hosting choice to every workload.
Why the other options fail by concept: Hosting all PHI triage prompts in a public cloud GenAI with no controls because cloud is always cheaper ignores privacy, contractual, and regulatory constraints on protected health information. Banning all cloud services even for non-PHI drafting regardless of classification forgoes legitimate, lower-risk productivity uses. Treating PHI and non-PHI workloads as identical so one unmanaged SaaS covers both collapses critical risk distinctions.
Exam caveat: “On-prem” is not automatically safe without access control, logging, and patching; “cloud” is not automatically forbidden if BAAs, data processing agreements, and redaction controls meet policy. Classification and control effectiveness matter more than slogans.
Operational check: Classify each assistant’s data flows (PHI vs non-PHI), select deployment accordingly, document DPAs/BAAs where cloud is used, enforce minimization and retention, and inventory the two systems separately with different owners and monitoring. Re-review if the drafting helper ever starts ingesting clinical content.