SY0-701 Question 470
Single answerExternal: Regulatory , Examinations , AssessmentA regional healthcare provider is preparing for an unannounced review by a government regulator after reporting a possible exposure of electronic protected health information (ePHI). The security manager has already completed an internal risk assessment and remediated several issues. To best support the upcoming external review, which action should the organization take FIRST?
- A
Compile current security policies, risk assessment results, remediation evidence, and audit logs that demonstrate compliance controls are operating effectively
- B
Delay providing documentation until the regulator formally requests each specific item to avoid disclosing unnecessary information
- C
Ask the internal audit team to reclassify the review as a penetration test so technical findings can be emphasized over compliance gaps
- D
Purge older system logs that are not directly related to the reported incident to reduce the amount of data the regulator must examine
Show answer and explanation
Correct answer: A
Explanation
The best answer is to compile and organize evidence for the external regulatory examination. In practice, regulators assess whether the organization has appropriate controls, whether those controls are documented, and whether the organization can demonstrate ongoing compliance through records and auditability. In healthcare environments, this aligns with HIPAA Security Rule expectations around risk analysis, policies and procedures, audit controls, and documentation retention. More broadly, external assessments and examinations rely on evidence such as policies, system configurations, corrective action plans, and logs. Common best practices from audit and compliance frameworks, including NIST guidance on risk assessments and security control assessments, emphasize maintaining documentation and objective evidence to support external review. The distractors are incorrect because they either delay cooperation, confuse a regulatory examination with a different type of assessment, or improperly remove evidence that may be required.
- A. Correct.
Correct. During an external regulatory examination, the organization should be prepared to provide organized, current evidence showing that required controls exist and are functioning. For a healthcare entity handling ePHI, this typically includes policies, risk analysis documentation, corrective action records, access and audit logs, and other artifacts that demonstrate due diligence and compliance. This is the most appropriate first step because it directly supports the regulator's assessment process and shows readiness, transparency, and control maturity.
- B. Incorrect.
Incorrect. Waiting passively for each request can slow the examination, create the appearance of disorganization, and undermine confidence in the organization's compliance posture. While organizations should avoid oversharing irrelevant material, they should proactively organize and prepare evidence likely to be requested in a regulatory assessment.
- C. Incorrect.
Incorrect. A regulatory examination is not the same as a penetration test. Reframing the review around technical testing does not address the regulator's need to verify administrative, technical, and procedural compliance obligations. This option reflects the misconception that strong technical testing alone satisfies regulatory scrutiny.
- D. Incorrect.
Incorrect. Deleting or purging logs before an external review is a serious mistake. Audit records may be needed to demonstrate control effectiveness, support incident reconstruction, and satisfy retention requirements. Reducing available evidence can be viewed as poor records management or even obstruction, depending on the circumstances.