A healthcare company wants to use generative AI to summarize patient records but must comply with HIPAA. Which deployment option should they choose?
Full control over data and compliance.
Why this answer
An on-premises deployment of an open-source model ensures that all patient data remains within the organization's controlled infrastructure, never leaving the local network. This eliminates any risk of data transmission to external cloud services, which is critical for HIPAA compliance where protected health information (PHI) must be safeguarded against unauthorized access or breaches. On-premises solutions allow the organization to implement its own security controls, encryption, and audit trails without relying on a third-party's compliance posture.
Exam trap
The trap here is that candidates assume cloud providers like Google Cloud or AWS are automatically HIPAA-compliant with data residency, but they overlook the shared responsibility model and the need for a BAA, which still exposes data to the provider's infrastructure and potential third-party risks, making on-premises the only option that guarantees full data control.
How to eliminate wrong answers
Option A is wrong because Vertex AI on Google Cloud, even with data residency, still involves data processing on Google's infrastructure, which requires a Business Associate Agreement (BAA) and may not satisfy all HIPAA requirements if the organization cannot fully control data access or auditing. Option B is wrong because Google Workspace AI is a SaaS offering that processes data on Google's servers, and while it can be HIPAA-compliant with a BAA, it introduces shared responsibility and potential data exposure risks that an on-premises solution avoids. Option D is wrong because using a third-party API means sending PHI to an external service, which requires the third-party to be HIPAA-compliant and sign a BAA, but it still exposes data to network transmission and external processing, increasing the attack surface and compliance burden.