AIF-C01 Question 214
Select 4A healthcare organization is planning to deploy an AI model on AWS to analyze patient data and provide diagnostic recommendations. The organization must ensure compliance with industry regulations like HIPAA and maintain proper governance. Which of the following actions should the organization take to meet governance and compliance requirements?
- A
Enable AWS CloudTrail to log all API activity related to the AI system.
- B
Use Amazon SageMaker Model Registry for version control and traceability of deployed AI models.
- C
Encrypt all patient data at rest and in transit using AWS Key Management Service (KMS).
- D
Rely solely on AWS services' built-in compliance certifications without conducting internal audits.
- E
Implement identity and access management (IAM) policies to restrict access to patient data based on roles.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To ensure compliance with governance and regulatory requirements such as HIPAA in a healthcare context, organizations must implement robust practices for security, traceability, and access management. This includes enabling logging and monitoring, managing model versions, encrypting sensitive data, and enforcing access controls. Relying solely on AWS's built-in compliance certifications is insufficient because compliance is a shared responsibility between AWS and the customer.
- A. Correct.
Enabling AWS CloudTrail helps log and monitor API activity, ensuring accountability and traceability, which are crucial for governance and compliance.
- B. Correct.
Amazon SageMaker Model Registry enables version control and traceability for AI models, which is important for governance and auditing purposes.
- C. Correct.
Encrypting patient data at rest and in transit using AWS Key Management Service (KMS) ensures compliance with regulations like HIPAA that require secure handling of sensitive data.
- D. Incorrect.
Relying solely on AWS's built-in compliance certifications is not sufficient. Organizations are responsible for their own compliance and must conduct their internal audits and processes.
- E. Correct.
Implementing IAM policies to restrict access based on roles is a key governance practice to ensure only authorized individuals can access sensitive data.