The correct option is Leakage of Personally Identifiable Information and Protected Health Information to the external service.

The transcript contains the client’s full name, date of birth, home address, and a diagnosis code, which together constitute PII and PHI. Placing this data into a third party generative AI platform sends highly sensitive information outside the clinic’s controlled environment. This creates the risk that the vendor could store it, log it, or use it to improve services unless strong data handling safeguards are in place, which could violate contractual and regulatory obligations. This exposure is the most critical privacy risk in the scenario.

Prompt injection is a manipulation technique that tries to make a model follow attacker supplied instructions. While it is a security concern, it is not the principal privacy risk presented by pasting identifiable health data into an external service.

Model hallucination refers to incorrect or fabricated outputs. Although it can reduce the quality or accuracy of a summary, it does not inherently expose the client’s private data to an external party.

Algorithmic bias involves unfair or discriminatory outputs related to model training or design. It is not the immediate privacy threat in this case where the main issue is the disclosure of identifiable health information to a third party.

Full AWS Practitioner Certification Question