You are the Dynamics 365 administrator for a healthcare provider that uses Customer Insights to manage patient profiles. The organization must comply with HIPAA regulations. Patient data is sourced from an electronic health record (EHR) system and from a patient portal. The EHR system is on-premises and sends data via a nightly batch file in CSV format. The patient portal sends data in real-time via API. You need to ensure that all patient data in Customer Insights is encrypted at rest and in transit. The platform already encrypts data at rest by default. However, you are concerned about the data in transit from the EHR system. What should you do?
Secures data in transit.
Why this answer
SFTP (SSH File Transfer Protocol) encrypts the CSV file during transit, addressing the concern about data in transit from the on-premises EHR system. Since the EHR sends data via a nightly batch file, using SFTP ensures the file is encrypted over the network, complementing the platform's default encryption at rest. This aligns with HIPAA requirements for protecting ePHI during transmission.
Exam trap
The trap here is that candidates may confuse encrypting the file itself (Option A) with securing the transfer channel, or assume that double encryption at rest (Option D) covers transit, when in fact HIPAA requires encryption both at rest and in transit, and the question specifically targets the transit vulnerability from the on-premises EHR system.
How to eliminate wrong answers
Option A is wrong because encrypting the CSV file before upload does not protect the data during transit; the file would still be transmitted in an unencrypted state unless the transfer protocol itself is secured. Option B is wrong because changing the patient portal API to use batch uploads addresses throughput or efficiency, not encryption in transit; the API already uses real-time data transfer, and batch uploads do not inherently add encryption. Option D is wrong because double encryption at rest in Customer Insights is a redundant security measure for data already encrypted at rest and does not address the data-in-transit concern from the EHR system.