MLA-C01 Question 114
Select 3You are building a machine learning model to predict health outcomes based on patient data for a healthcare provider. The dataset contains sensitive information, including Protected Health Information (PHI). The healthcare provider requires the solution to comply with HIPAA regulations. Which of the following actions should you take to ensure compliance with these requirements?
- A
Use AWS services that are HIPAA-eligible, such as Amazon S3 and Amazon SageMaker, and sign a Business Associate Agreement (BAA) with AWS.
- B
Encrypt the PHI data both in transit and at rest using AWS Key Management Service (KMS).
- C
Store the PHI data in an Amazon S3 bucket with public read access for transparency.
- D
Limit access to PHI data by implementing IAM policies with the principle of least privilege.
- E
Ensure that PHI data is stored in regions where HIPAA compliance is not required to reduce costs.
Show answer and explanation
Correct answers: A, B, D
Explanation
Compliance with regulations such as HIPAA requires a combination of technical and administrative measures. Using HIPAA-eligible AWS services and signing a BAA ensures the legal framework is in place. Encrypting data and limiting access to PHI are critical technical measures that align with compliance requirements. Publicly exposing or improperly storing PHI data contradicts HIPAA's security and privacy mandates.
- A. Correct.
This is correct. AWS provides HIPAA-eligible services, and signing a Business Associate Agreement (BAA) is necessary to meet HIPAA compliance requirements.
- B. Correct.
This is correct. Encrypting PHI data both in transit and at rest is a critical step for ensuring data security and compliance with HIPAA.
- C. Incorrect.
This is incorrect. Making PHI data publicly accessible violates HIPAA regulations and poses a significant security risk.
- D. Correct.
This is correct. Restricting access to PHI using IAM policies aligns with the principle of least privilege and is essential for compliance.
- E. Incorrect.
This is incorrect. Storing PHI in regions where HIPAA compliance is not required does not align with regulatory requirements and could result in non-compliance.