Google Professional Cloud Security Engineer Question 470
Select 4Google Cloud PlatformYour organization processes sensitive healthcare data using Google Cloud services and must comply with HIPAA regulations. As the Cloud Security Engineer, what steps should you take to ensure compliance with HIPAA requirements when using Google Cloud?
- A
Sign a Business Associate Agreement (BAA) with Google Cloud.
- B
Ensure all data is encrypted at rest and in transit using FIPS 140-2 compliant encryption.
- C
Use only Google Cloud services labeled as HIPAA compliant.
- D
Disable all logging and monitoring features to avoid storing sensitive data in log files.
- E
Implement access controls and audit logging to monitor access to sensitive data.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To adhere to HIPAA regulations when using Google Cloud, you must sign a BAA with Google, ensure proper encryption, use only HIPAA-compliant services, and implement robust access controls and audit logging. Disabling logging and monitoring is unnecessary and would reduce visibility into potential security incidents. These steps collectively ensure compliance with regulatory and industry standards for handling healthcare data in the cloud.
- A. Correct.
A Business Associate Agreement (BAA) is mandatory to use Google Cloud for processing Protected Health Information (PHI) under HIPAA.
- B. Correct.
HIPAA requires that sensitive data be encrypted using FIPS 140-2 compliant encryption both at rest and in transit to protect it from unauthorized access.
- C. Correct.
Only Google Cloud services that are explicitly labeled as HIPAA compliant can be used to process PHI.
- D. Incorrect.
Disabling logging and monitoring is not a recommended practice. Instead, you should configure logs to avoid sensitive data being stored while still maintaining visibility and monitoring for security incidents.
- E. Correct.
Access controls and audit logging are essential to ensure that only authorized users access sensitive data and that all access is monitored and logged for compliance purposes.