Question 720
A cross-border patient portal stores identifiable records in a new region without reviewing local healthcare privacy rules. The team has identified a response and must obtain a justified decision before moving forward. Which next decision BEST preserves the agreed business outcome?
Explanation
Correct Answer
This decision respects the accountable project authority and the scenario’s remaining exposure: Stop the noncompliant data migration until the appropriate legal signoff and safeguards are documented. The response being governed is Map residency, access, consent, and processor obligations into design controls with legal and privacy owners. and the completion measure is Privacy assessments and deployment evidence show data flows meet applicable jurisdictional requirements.
Incorrect Answers
Escalate inadequate disclosure evidence before declaring sustainability obligations met. That safeguard does not address the specific risk here: encrypting records does not by itself resolve jurisdictional authorization or residency obligations. The relevant follow-up is: Stop the noncompliant data migration until the appropriate legal signoff and safeguards are documented.
Seek an investment go/no-go decision if forecast benefit no longer justifies the planned scope. That safeguard does not address the specific risk here: encrypting records does not by itself resolve jurisdictional authorization or residency obligations. The relevant follow-up is: Stop the noncompliant data migration until the appropriate legal signoff and safeguards are documented.
Reserve capacity for verified systemic improvement when repeated defects exceed the risk tolerance. That safeguard does not address the specific risk here: encrypting records does not by itself resolve jurisdictional authorization or residency obligations. The relevant follow-up is: Stop the noncompliant data migration until the appropriate legal signoff and safeguards are documented.