Public-health case agents share only de-identified encounter codes when asking a scheduling agent for clinic slots. What does that protocol choice primarily enforce?
Select an answer to reveal the explanation.
Short Explanation
The scheduling agent needs a slot, not the patient's life story. Sending only de-identified encounter codes is the municipal version of need-to-know—enough to book, nothing extra to leak.
Full Explanation
Public-health case agents that share only de-identified encounter codes with a scheduling agent enforce minimum-necessary sharing: collaborators receive solely the fields required to obtain clinic slots, not full medical narratives or other protected details. That protocol choice operationalizes least-privilege data exchange in multi-agent civic healthcare workflows.
Maximizing data sharing so every agent stores full medical narratives fails because it violates need-to-know and expands breach impact. Replacing scheduling systems with unrestricted PHI broadcasts fails by concept: it abandons both the scheduling system of record and privacy controls. Deleting all encounter codes before any inter-agent call fails because the scheduling agent then lacks the minimal key required to book the right clinic pathway—minimum necessary is not “share nothing.”
Exam caveat: minimum-necessary / least-privilege sharing is a data-minimization principle. Do not confuse it with deleting identifiers required for the task, or with open publication of health data.
Operational check: capture the inter-agent payload on a test booking; assert only approved de-identified encounter codes (and scheduling parameters) appear; attempt injection of narrative PHI fields and verify the protocol strips or rejects them before the scheduling agent runs.