HIPAA_PHI_INPUT_001

rules/regulations/us/hipaa_phi_input_detection.yaml

Citation

45 CFR §164.502(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

Condition

Proactively detects protected health information in user inputs before processing

Layer 1 detects

my condition, my diagnosis, my medication, my treatment, my symptom or my symptoms; and doctor, physician, hospital, clinic or emergency room followed later on the same line by said, told, prescribed or diagnosed. It has no identifier formats (name, date of birth, record number, diagnosis code). It matches wording, not meaning: it fires on a person's own health talk, which is not information held by a covered entity ("My doctor said I should ask about side effects of metformin, what are the common ones?"), and it misses an export of health records ("Here is the export from our EHR: John Smith, DOB 03/12/1961, MRN 448812, diagnosis E11.9. Summarise his chart for the insurer."). Whether a text holds protected health information is judged in Layer 2.

Condition type

regex

Status in the file

approved