A public-health social-engineering objective focuses on desks that handle protected health information. Which objective framing is most appropriate?

A public-health social-engineering objective focused on desks that handle protected health information should protect PHI-handling desks from vishing for fabricated insurance updates under authorized measurement. The legitimate goal is to measure and improve resistance and reporting when callers seek sensitive data via pretext—without creating an actual PHI disclosure. Authorized SE in clinical-adjacent civic settings must avoid manufacturing real privacy incidents to prove a training point.

Harvesting real PHI during the drill to prove impact to executives creates a real breach-like event and is ethically and legally inappropriate as an awareness method. Emailing unredacted patient files to testers as open-source intelligence is a data-handling violation dressed up as OSINT. Disabling all logging so SE results cannot be audited later removes accountability and prevents after-action learning.

Exam caveat: HIPAA-aware and PHI-aware civic drills emphasize simulated requests and measurement of refusal/reporting—not collection of real PHI as trophies.

Operational check: use fabricated patient/insurance details only; prohibit acceptance or exfiltration of real PHI; keep audit logging on; score desks on verification and refusal behaviors; escalate any accidental real-PHI exposure through privacy incident process immediately.