Preventing PII Leakage in Bedrock Model Outputs
A hospital is building an AI application to help medical clinicians to make treatment decisions. The application uses Amazon Bedrock to analyze patient case histories and suggest diagnoses. The application must maintain sub-500 ms response times to integrate with the hospital’s existing real-time clinical workflow. To comply with privacy regulations, the application must log all per-sonally identifiable information (PII) handling decisions for audits. The application must detect and remove PII from responses with at least 99% accuracy. After initial deployment, clinicians report that diagnostic summaries from the application occa-sionally include patient names and medical record numbers that were not present in the original case history inputs. An investigation reveals that Amazon Comprehend Medical successfully de-tects and removes PII from inputs with 95% accuracy, and the application replaces all detected entities with tokens before it sends inputs to Amazon Bedrock. However, the application contin-ues to generate patient-identifying information in approximately 3-5% of outputs. The company needs a solution to prevent the application from displaying PII in outputs while meeting all other operational requirements. Which solution will meet these requirements?
Community Insight
The tested skill is placing the privacy control on the correct side of the model call; the common trap is adding more input preprocessing when the PII is being generated, not passed through.
This clinical AI scenario tests how to stop personally identifiable information from appearing in Amazon Bedrock model responses when input-side scrubbing already works. Amazon Bedrock guardrails with sensitive information filters operate directly on generated output, which is the only option that addresses the actual 3-5% output leak while preserving sub-500 ms latency and audit logging.
Option B is the most tempting wrong answer because it appears to 'raise accuracy,' but the investigation proved inputs are already tokenized before Bedrock, so a second input-side regex and custom entity recognizer cannot catch identifiers the model invents in its response.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon Bedrock guardrails with sensitive information filters evaluate the model's generated response before it is returned, which is exactly where the 3-5% of offending patient names and medical record numbers appear. Because the investigation confirmed inputs are fully tokenized prior to Bedrock, the leak is generative rather than translational, so output-side filtering is the only placement that intercepts it. Guardrails also emit block reasons and content filter logs that satisfy the requirement to record every PII handling decision for audits, and they run as a lightweight in-stream filter that does not threaten the sub-500 ms clinical workflow budget. Sensitive information filters can be tuned for custom entity types such as medical record numbers, supporting the at-least-99% removal target.Exam Strategy
Read where the failure occurs before choosing a control: the scenario deliberately tells you inputs are already tokenized, so any option that only hardens preprocessing is a distractor. In privacy questions, match the safeguard to the exact data path (input, model, or output) plus the stated latency and logging constraints.
Frequently Asked Questions
Why doesn't a second input-side PII detector fix the 3-5% output leak?
The offending identifiers are generated by the model, not carried over from inputs, since all detected input entities were already replaced with tokens before Bedrock was called.
How do Bedrock guardrails satisfy the audit logging and latency requirements?
Guardrails return block reasons and content filter metadata for every PII handling decision, and they run as a lightweight stream filter rather than a second full inference pass.
Related Analysis
Practice All AIP-C01 Questions
Access 110 questions with complete answers and detailed explanations.
View Full AIP-C01 Practice Test →