Public health reviews a vendor model that may process clinic admin data. Which regulatory-aligned vendor check is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Where the bits live still matters. Check that training and processing regions match residency rules for clinic admin data—cheap GPUs don’t rewrite the law.
Full Explanation
Public health reviewing a vendor model that may process clinic admin data must check location and residency constraints that regulation and policy often impose. Confirm whether training and processing regions meet residency requirements for clinic admin data is correct because clinic-adjacent administrative data can be subject to residency, localization, or approved-region rules even when it is not full clinical charts. AI vendors can train or process in regions that violate those constraints unless the city/county verifies and contracts for allowed regions.
Ignore residency because cloud regions are always equivalent for civic PHI-adjacent data fails by concept: regions are not legally or contractually equivalent for regulated civic data. Choose the vendor solely by which region has the cheapest GPU hour fails by concept: cost optimization cannot override residency/compliance requirements. Assume residency rules never apply to AI vendors serving public health fails by concept: AI processing does not create a blanket exemption from data-location obligations.
Exam caveat: residency requirements vary by jurisdiction and data classification—the exam tests that you verify alignment, not that every clinic admin field is PHI. Training region and inference region can differ; check both if the vendor separates them.
Operational check: classify the clinic admin data in scope; extract residency/processing constraints from policy and contracts; obtain the vendor’s training and processing region list; verify allowlisting in the agreement; and block production use until regions match requirements or a documented legal exception exists.