Before "it leaked": scope it first, Claude Code case shows

Endoh's essay is built on a self-imposed limit: he says he drew only on his own published Qiita and note articles, public reporting, and public information about the Act on the Protection of Personal Information and the Pharmaceuticals and Medical Devices Act. He states that actual investigation procedures, his organization's response flow, and the data it holds are not included. That framing matters because his argument is about sequence, not tactics.

The comparison he draws runs across three domains. In hospital infection control, the first move is to define the scope of the cluster — which wards, which period, which patient groups — before epidemiological investigation, cause analysis, and prevention measures. For medical devices, manufacturers must report malfunctions to PMDA under the Pharmaceuticals and Medical Devices Act, and Endoh notes those reports rest on pinning down how a failure occurs and its incidence rate before cause and safety measures are considered. Under Article 26 of the Personal Information Protection Act, mandatory-report categories and required report items such as the number of affected individuals and the categories of leaked information encode the same idea, as does the two-stage preliminary and final reporting flow.

He is careful to call the infection-control summary a generalized arrangement based on notices such as the Ministry of Health, Labour and Welfare's guidance, and directs readers to the Personal Information Protection Commission's official guidelines and report forms for detail. The piece closes with a disclaimer that it reflects his personal view, is not legal advice, and that regulatory judgments should go to an organization's responsible officers, security team, or experts.