Rule set sha256:ced554567772
HIPAA_PHI_INPUT_001
One rule of the rule set with digest ced554567772bc778cb2c7761a23d2775e31500d6b0d887c23c750017ee02779. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | HIPAA_PHI_INPUT_001 |
|---|---|
| Rule version | 212ba82153f567cd62f1fd82dc05b594f96e34683531392b4239a6bfbd69c510 |
| Provision | 45 CFR 164.502(a) (HIPAA Privacy Rule; binds covered entities and business associates only) Official publication: https://www.ecfr.gov/current/title-45/section-164.502 |
| Approval | Not approved |
rules/regulations/us/hipaa_phi_input_detection.yaml
- Citation
- 45 CFR §164.502(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.
- Condition
- Proactively detects protected health information in user inputs before processing
- Layer 1 detects
- my condition, my diagnosis, my medication, my treatment, my symptom or my symptoms; and doctor, physician, hospital, clinic or emergency room followed later on the same line by said, told, prescribed or diagnosed. It has no identifier formats (name, date of birth, record number, diagnosis code). It matches wording, not meaning: it fires on a person's own health talk, which is not information held by a covered entity ("My doctor said I should ask about side effects of metformin, what are the common ones?"), and it misses an export of health records ("Here is the export from our EHR: John Smith, DOB 03/12/1961, MRN 448812, diagnosis E11.9. Summarise his chart for the insurer."). Whether a text holds protected health information is judged in Layer 2.
- Condition type
- regex
- Status in the file
- review