mediumMultiple SelectObjective-mapped
CRISC Practice Question: A healthcare organization is migrating its…
A healthcare organization is migrating its electronic health records (EHR) system to a public cloud. The risk manager identifies several risks. Which TWO of the following are the MOST significant risks related to data privacy and regulatory compliance?
⚠ Common exam trap
Many exam-takers confuse operational risks (like downtime) or general security risks (like access control) with the specific regulatory and privacy risks that are most significant for healthcare data in the cloud, while overlooking the foundational compliance requirements of data residency and encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data residency and jurisdiction issues.
Data residency and jurisdiction issues (B) are a top risk because healthcare data is subject to strict regulations like HIPAA and GDPR, which may require data to remain within specific geographic boundaries. Migrating EHRs to a public cloud can inadvertently place data in regions with different legal protections, exposing the organization to non-compliance and legal penalties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Potential for service downtime affecting patient care.
Why it's wrong here
Downtime is an availability risk, not specifically privacy/compliance.
- ✓
Data residency and jurisdiction issues.
Why this is correct
Data may be stored in countries with inadequate privacy laws.
- ✗
Loss of control over the cloud provider's internal access controls.
Why it's wrong here
Loss of control is a general risk but not the most significant for privacy.
- ✓
Insufficient encryption of data at rest and in transit.
Why this is correct
Inadequate encryption directly risks data confidentiality and compliance.
- ✗
Vendor lock-in due to proprietary APIs.
Why it's wrong here
Vendor lock-in is a business risk, not primarily privacy/compliance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.