MLS-C01 Question 354
Select 3A healthcare organization is building a machine learning model to predict patient outcomes based on sensitive health records stored in Amazon S3. The organization must comply with HIPAA regulations, ensuring that the data is encrypted both at rest and in transit, and that personally identifiable information (PII) is anonymized during preprocessing. Which combination of approaches should the organization use to meet these compliance requirements while preparing the data for the ML model?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) for the Amazon S3 bucket storing the data.
- B
Use AWS Glue DataBrew to detect and mask PII in the dataset before training the model.
- C
Transfer data from Amazon S3 to the training environment using an encrypted Amazon S3 bucket policy.
- D
Use client-side encryption to encrypt data before uploading it to Amazon S3.
- E
Perform anonymization of the PII data by replacing it with synthetic data generated via AWS SageMaker Data Wrangler.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet HIPAA compliance, the healthcare organization must prioritize encryption and anonymization. Enabling server-side encryption with AWS KMS ensures data is encrypted at rest, while AWS Glue DataBrew can be used to detect and mask PII in the dataset. Additionally, anonymizing PII by replacing it with synthetic data ensures that sensitive information is not exposed during the training process. These approaches collectively fulfill the encryption and anonymization requirements specified.
- A. Correct.
This is correct because enabling server-side encryption with AWS KMS ensures that the data stored in Amazon S3 is encrypted at rest, meeting compliance requirements.
- B. Correct.
This is correct because AWS Glue DataBrew can identify and mask PII in data, ensuring compliance with HIPAA requirements for anonymization.
- C. Incorrect.
This is incorrect because encrypted bucket policies do not exist. Bucket policies control access but do not directly encrypt data in transit or at rest.
- D. Incorrect.
This is incorrect because while client-side encryption adds an extra layer of security, it is not required here as server-side encryption with AWS KMS already meets the needs for encryption at rest.
- E. Correct.
This is correct because replacing PII with synthetic data is a valid anonymization technique that ensures no real-world sensitive data is exposed during the training of the ML model.