A public-health clinic must protect ePHI confidentiality and keep the after-hours nurse line available. What should the analyst tell leadership about this CIA trade-off?
Select an answer to reveal the explanation.
Short Explanation
The clinic cannot pick a favorite child between keeping charts private and keeping the night nurse reachable. Say both stay on the board, then use ES to watch for leaks and for the line going dark. CIA is a balance, not a hall pass to ignore one side.
Full Explanation
A public-health clinic that must protect ePHI confidentiality and keep the after-hours nurse line available should hear that both confidentiality and availability stay in scope, and Enterprise Security can monitor failures on each side. Civic health cannot pick a favorite child between private charts and reachable night nurses. CIA trade-offs are managed with monitoring and policy, not by declaring one property forever wins.
Saying confidentiality always wins so the nurse line can be taken offline whenever ePHI is in scope fails by concept: availability of care is still a required property. Saying availability always wins so ePHI monitoring can be turned off fails by concept: confidentiality of health data remains mandatory. Claiming CIA trade-offs do not apply to civic health systems so only malware hashes matter fails by concept: health systems are classic CIA balancing environments.
Exam caveat: Stems that present two CIA needs usually expect both to remain in scope with monitoring—not a single-property absolute.
Operational check: Enable detections for unauthorized ePHI access patterns and for nurse-line or telephony/service outages, and brief clinic leadership that ES watches both sides of the trade-off rather than turning either off.