Your scrum team is working on a healthcare application where regulatory compliance is critical. During the sprint, a team member discovers that a completed story from the previous sprint doesn't meet new HIPAA requirements that were recently clarified by the compliance department. The feature is already in the staging environment and was demonstrated to stakeholders. The Definition of Done includes 'meets all regulatory requirements,' but this specific requirement wasn't known during development. What should the scrum master facilitate?

Question

Accepted Answer

The correct answer is D. Addressing the compliance issue immediately (option D) is correct because regulatory violations in healthcare represent legal and ethical risks that cannot be deferred based on business priorities. The Definition of Done was violated ('meets all regulatory requirements'), meaning the story should never have been considered complete (PMBOK 8 Principle of Build Quality into Processes). Option C is the main distractor because it seems to follow servant leadership and product owner authority, but compliance isn't negotiable—the product owner cannot deprioritize legal requirements. Option A treats this as a normal backlog item when it's actually a critical defect requiring immediate attention. Option B's research spike might be useful later, but the immediate non-compliance must be addressed first. Agile doesn't mean compromising on quality or compliance; it means responding quickly when such issues are discovered.

More Process Questions