A public-health agent is asked to email full medical notes to a personal address. What compliance guardrail should apply?
Select an answer to reveal the explanation.
Short Explanation
You’re right to treat full medical notes in a personal inbox as a serious privacy risk. Privacy guardrails should block the email and keep you within policy, even when the request sounds urgent.
Full Explanation
Applying privacy guardrails that block agents from emailing full medical notes to personal addresses is the compliant response. Sending the complete clinical content to an uncontrolled personal inbox can violate confidentiality, HIPAA-analogue municipal privacy requirements, and records-handling rules, regardless of urgency. The agent should detect the full notes and personal destination as an exfiltration risk and refuse or escalate; enforcement belongs in the email tool path, not in optional courtesy. Sending full notes whenever a request sounds urgent fails because urgency does not change privacy law or city policy, and social-engineering pressure is precisely when automated blocks must hold. Stripping filenames while still emailing the clinical content fails because the protected information is the medical substance, not its filename. Allowing the complete notes to go to a personal inbox after the recipient confirms it is highly secure also fails: a personal destination remains outside approved controls, and a claim of security does not make the exception safe. Exam caveat: NCP-AAI privacy/compliance items test whether you apply firm data-handling guardrails under urgency and partial-mitigation distractors. For a practical check, configure DLP/privacy policies on the agent’s email tool to block full medical-note bodies and attachments to personal domains; test a staged request, confirm refusal messaging and a security/compliance alert, and verify that legitimate disclosure workflows remain available through approved clinical channels.