Question

A penetration testing firm has completed a web application assessment for a healthcare client subject to HIPAA. During testing, the team captured screenshots and database extracts containing protected health information (PHI) to demonstrate exploit impact. As the engagement closes, the client's compliance officer asks how the firm will handle the sensitive data it collected. Which action BEST satisfies the firm's obligations at engagement closeout?

Accepted Answer

Follow the data retention and secure destruction procedures defined in the rules of engagement, then provide the client a certificate of destruction

Answer

Retain the captured PHI indefinitely on the firm's servers so it can be referenced if the client disputes any finding

Answer

Immediately delete all evidence, including the final report, to eliminate any liability for holding PHI

Answer

Upload the collected PHI to the client's public ticketing system so their staff can independently verify each finding