A clinic's IT director plans to host electronic health records on Google Cloud and needs documentation proving the platform can support healthcare privacy obligations before legal approves the project. What should the director obtain?
Show answer and explanation
Answer: C
Google Cloud publishes independent audit reports and certifications, and customers can review the relevant evidence through the Compliance Reports Manager. For protected health information covered by HIPAA, the customer must also execute a Business Associate Agreement with Google and keep that data on services the agreement covers. Documentation plus the contract gives legal and compliance teams what they need before go-live. Shared responsibility still applies, so the clinic remains accountable for how it configures access and handles data.
Why the other options are wrong
- A. A sales representative's verbal promise is not documentary evidence, and auditors and legal teams cannot rely on it for a regulated workload.
- B. A clinic cannot audit a hyperscale provider's data centers itself. Customers rely on independent third-party audit reports and contract terms instead.
- D. Cloud Armor is a DDoS and web application firewall service. It provides network protection, not a HIPAA certification or a signed contract.
Exam tip. For regulated data, the answer usually pairs compliance reports with a contractual agreement such as a BAA.