CCAR-P Governance, Safety, and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a custom model fine-tuned on public medical journals to avoid using patient data.

  Why it's wrong here

  Fine-tuning on journals does not address the privacy of the patient clinical notes being processed at runtime. Even with a fine-tuned model, the actual patient data must be handled according to HIPAA, which requires a BAA and strict encryption, regardless of the model's training source.

• ✓

  Ensure that a Business Associate Agreement (BAA) is in place and strictly enforced.

  Why this is correct

  The BAA is a legal requirement under HIPAA for any cloud service provider handling PHI. Without this agreement, the healthcare provider is in direct violation of the law. This is the paramount governance step, as it defines the legal responsibility and privacy safeguards that must be maintained.

• ✗

  Implement a strict 24-hour limit on the storage of all processed clinical summaries.

  Why it's wrong here

  While data retention policies are important, HIPAA compliance is not simply about duration of storage. The fundamental requirement is to have the correct legal agreements and encryption measures in place. A 24-hour limit does not substitute for the mandatory legal framework required for PHI processing.

• ✗

  Anonymize all patient notes by removing names before sending them to the API.

  Why it's wrong here

  Anonymization is complex and often insufficient for full HIPAA compliance, as other identifiers could still lead to re-identification. Furthermore, even de-identified data is still subject to strict governance. A BAA remains the primary regulatory requirement for the secure, legal processing of health-related information.