A global health insurance company is concerned about protecting confidential information. Which of the following is of MOST concern to this organization?

Question

Options

• ACompliance to the Payment Card Industry (PCI) regulations.
• BAlignment with financial reporting regulations for each country where they operate.
• CAlignment with International Organization for Standardization (ISO) standards.
• DCompliance with patient data protection regulations for each country where they operate.

• A
  15% (6)
• B
  7% (3)
• C
  5% (2)
• D
  73% (30)

Explanation

For a global health insurance company, patient data protection is the core business concern - health records are among the most sensitive personal data categories, and violating these regulations carries severe legal, financial, and reputational consequences worldwide (e.g., HIPAA in the US, GDPR in the EU).

• A is wrong because PCI applies to payment card processing, not to the health data that defines this company's primary risk surface.
• B is wrong because financial reporting regulations are an accounting/compliance concern, not a confidential information protection concern.
• C is wrong because ISO standards (like ISO 27001) are voluntary frameworks, not legally binding obligations - alignment is beneficial but not the most pressing concern compared to mandatory legal compliance.

Memory tip: Match the company type to its data type - a health insurer's most sensitive asset is health (patient) data, so the regulation protecting that data is always the top concern. When in doubt, ask: "What data does this organization live and die by?"

No community discussion yet for this question.