A research hospital wants to train a diagnostic model using ten years of patient imaging and lab records. Before any data scientist can access the dataset, the hospital's IT team strips out direct identifiers such as names and medical record numbers, encrypts the data at rest, and restricts access to a small approved team under audited credentials. Which responsible AI principle are these controls primarily supporting?
Select an answer to reveal the explanation.
Short Explanation
Before this hospital lets anyone even look at ten years of patient records to build a model, they're locking that data down like a vault: names and record numbers get stripped out, the files get encrypted, and only a small, audited team gets a key in. None of that changes how the eventual model behaves toward different patients, and none of it makes the tool easier to use for people with different abilities. It's purely about keeping sensitive personal information from leaking out or falling into the wrong hands while it's being used to train something. That's the whole point of these steps: protect the people behind the data, not just the data itself, by minimizing what identifying details are even present and tightly controlling who can ever touch the raw records. If you see identifiers being removed, encryption being applied, and access being restricted, that's a strong signal you're looking at data protection controls rather than anything about the model's eventual behavior.
Full Explanation
The correct answer is D. Privacy and security is the principle concerned with protecting personal data throughout its lifecycle, including limiting who can access it, removing identifying details when possible, and safeguarding it from unauthorized exposure. Stripping direct identifiers, encrypting the dataset at rest, and restricting access to a small audited team are all concrete controls aimed at keeping sensitive patient information protected while still allowing the model to be trained. Option A is incorrect because fairness concerns whether a system's outputs treat different groups of people equitably, which is a separate question from how the underlying data is secured and de-identified. Option B is incorrect because reliability and safety concerns whether the resulting model performs consistently and safely once built and deployed, not how the training data was protected beforehand. Option C is incorrect because inclusiveness concerns designing systems so people of varying abilities and backgrounds can use them effectively, which has nothing to do with data access controls or de-identification. The controls described here exist specifically to reduce the risk of patient data being exposed or misused, which is the essence of privacy and security.