Question

A healthcare company deploys a RAG chatbot that answers clinician questions using patient-derived summaries stored in a Delta table. The compliance team requires that any table, function, or model that touches protected health information (PHI) be discoverable and enforceable through a single governance mechanism, so that access policies and audits can be applied consistently across all these assets in Unity Catalog. Which approach best satisfies this requirement?

Accepted Answer

Apply Unity Catalog governed tags (sensitivity classifications) to the PHI table, the registered model, and related functions, then use tag-based access policies and audit queries to enforce and review access consistently.

Answer

Add a comment field noting 'contains PHI' on each asset and instruct engineers to check comments before granting access.

Answer

Store all PHI assets in a separate workspace and rely on workspace-level admin controls to restrict who can log in.

Answer

Encrypt the PHI column values in the source table so the model cannot read identifiable data, eliminating the need for governance tags.