Rule set sha256:a7e715b79299
HIPAA_PHI_INPUT_001
One rule of the rule set with digest a7e715b792994b004a7cc9714100077fad036164172ce42812ed396af0b727f5. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | HIPAA_PHI_INPUT_001 |
|---|---|
| Rule version | 57beaa38d76bf61a594fa07a1cc3ef05608f3d7ad5eb679b10369f0628a8e7b8 |
| Provision | 45 CFR 164.502(a) (HIPAA Privacy Rule; binds covered entities and business associates only) Official publication: https://www.ecfr.gov/current/title-45/section-164.502 |
| Approval | Approved Approved by Leo Celis (via agent review per §5.1 amendment v1.1) on 2026-10-22 |
rules/regulations/us/hipaa_phi_input_detection.yaml
- Citation
- 45 CFR §164.502(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.
- Condition
- Proactively detects protected health information in user inputs before processing
- Layer 1 detects
- my condition, my diagnosis, my medication, my treatment, my symptom or my symptoms; and doctor, physician, hospital, clinic or emergency room followed later on the same line by said, told, prescribed or diagnosed. It has no identifier formats (name, date of birth, record number, diagnosis code). It matches wording, not meaning: it fires on a person's own health talk, which is not information held by a covered entity ("My doctor said I should ask about side effects of metformin, what are the common ones?"), and it misses an export of health records ("Here is the export from our EHR: John Smith, DOB 03/12/1961, MRN 448812, diagnosis E11.9. Summarise his chart for the insurer."). Whether a text holds protected health information is judged in Layer 2.
- Condition type
- regex
- Status in the file
- approved