What regulatory reporting requirements might apply to telemetry exports?

• A. Data export auditing only.
• B. Health information privacy regulations; required disclosures for breach notifications; regulatory reporting per HIPAA/HITECH and state laws; possible data export auditing.
• C. No regulations apply.
• D. Only internal governance controls matter.

Answer: (B)

Regulatory requirements for telemetry exports center on privacy protections for health information and the need to report breaches. If telemetry data includes PHI, HIPAA/HITECH principles apply, dictating how PHI can be used, disclosed, and safeguarded, and they require notifying individuals (and sometimes authorities) if a breach of unsecured PHI occurs. State data breach laws can add to those requirements, so the regulatory landscape isn’t limited to federal rules. When exporting telemetry to external systems or partners, you’ll also want appropriate business arrangements (like BAAs) and robust controls, including audit trails to demonstrate what was exported and when. This is why the best answer emphasizes health information privacy regulations, required breach notifications, HIPAA/HITECH and state-law reporting, and possible data export auditing. The other options miss critical pieces: focusing only on auditing ignores privacy and breach rules, claiming no regulations apply ignores established laws, and relying solely on internal governance overlooks external regulatory obligations.