Contoso, a healthcare provider, is deploying a new patient portal on Azure App Service that stores electronic health records (EHR) in Azure Cosmos DB for NoSQL. The solution must comply with HIPAA and HITRUST. You need to ensure that data is encrypted at rest and in transit, and that access is restricted based on user roles. Cosmos DB must be configured with a private endpoint to prevent public internet access. You plan to use Azure Key Vault to manage encryption keys. Additionally, the application will access Cosmos DB using a system-assigned managed identity. Which of the following is the most complete and secure design?