Google Professional Data Engineer Question 17
Select 3Google Cloud PlatformYou are designing a data pipeline in Google Cloud for a healthcare organization that processes sensitive patient data. The organization must comply with HIPAA regulations. Which of the following actions should you take to ensure compliance with legal and regulatory requirements?
- A
Enable audit logging for all access to sensitive data.
- B
Store the data in a Cloud Storage bucket with public access enabled for easy sharing.
- C
Ensure encryption of data at rest and in transit.
- D
Sign a Business Associate Agreement (BAA) with Google Cloud.
- E
Use a non-regional storage option to ensure compliance with data residency requirements.
Show answer and explanation
Correct answers: A, C, D
Explanation
To ensure HIPAA compliance for sensitive healthcare data, you must implement measures to secure data, such as enabling audit logging, encrypting data at rest and in transit, and signing a BAA with Google Cloud. Public access to sensitive data is not permissible, and while data residency requirements may apply, using non-regional storage is not explicitly required for HIPAA compliance.
- A. Correct.
Enabling audit logging ensures that all access to sensitive data is tracked, which is a key requirement for HIPAA compliance.
- B. Incorrect.
Storing data in a publicly accessible Cloud Storage bucket violates the principle of data confidentiality and would not comply with HIPAA.
- C. Correct.
Encryption of data at rest and in transit is a fundamental requirement for securing sensitive data and complying with HIPAA.
- D. Correct.
Signing a Business Associate Agreement (BAA) with Google Cloud is required for HIPAA compliance to establish shared responsibilities.
- E. Incorrect.
Using a non-regional storage option does not directly address HIPAA requirements. Data residency requirements should be evaluated separately and do not inherently necessitate non-regional storage.