Question 1
Scenario 1: HealthGenic is a pediatric clinic that monitors the health and growth of individuals from infancy to early adulthood using a web-based medical software. The software is also used to schedule appointments, create customized medical reports, store patients’ data and medical history, and communicate with all the involved parties, including parents, other physicians, and the medical laboratory staff.
Last month, HealthGenic experienced a number of service interruptions due to the increased number of users accessing the software. Another issue the company faced while using the software was the complicated user interface, which the untrained personnel found challenging to use.
The top management of HealthGenic immediately informed the company that had developed the software about the issue. The software company fixed the issue; however, in the process of doing so, it modified some files that comprised sensitive information related to HealthGenic’s patients. The modifications that were made resulted in incomplete and incorrect medical reports and, more importantly, invaded the patients’ privacy.
Based on the scenario above, answer the following question:
Which of the following indicates that the confidentiality of information was compromised?
I agree with the community and the suggested answer of Option B. In information security frameworks like ISO/IEC 27001 (which the PECB Lead Implementer certification aligns with), confidentiality means ensuring that information is accessible only to those authorized to have access. The scenario explicitly states that the modifications "invaded the patients’ privacy," which directly reflects unauthorized disclosure or access to sensitive data, meaning confidentiality was compromised.
Reason
Option B is correct because the scenario explicitly notes that the software modification "invaded the patients' privacy." Patient privacy is inherently tied to the confidentiality pillar of the CIA triad (Confidentiality, Integrity, and Availability). When private health information is exposed or handled in a way that violates privacy, confidentiality has been breached.
Why the other options are not as suitable
- Option A is incorrect because service interruptions relate to a loss of availability, meaning systems and information were not accessible to authorized users when needed.
- Option C is incorrect because the unauthorized or accidental modification of medical reports represents a loss of integrity, which ensures that information remains accurate, complete, and unaltered.