A security analyst at a healthcare company is triaging an alert generated by an AI-based anomaly detection system. The alert flags a nurse who accessed 800 patient records in 4 hours. Before escalating as a potential insider threat, what contextual factor is most important to check?

• A.Whether the nurse has ever accessed more than 100 records in a single shift before
• B.Whether the nurse was working a mass-casualty shift, covering multiple wards, or performing a legitimate bulk record export for a quality improvement audit - all of which would explain the volume without indicating malicious activity
• C.The nurse's employment tenure, since new employees are statistically more likely to be insider threats
• D.Whether the records accessed are in the nurse's usual ward, since cross-ward access is always suspicious