Call now for cybersecurity help: 888-646-1616
Josh Ablett

HIPAA Data Security - Find PHI

October 20, 2020

The first step in performing a HIPAA security risk assessment is to be sure you understand what Protected Health Information (PHI) your practice has.

Here’s how Wikipedia defines PHI: “Under the US Health Insurance Portability and Accountability Act (HIPAA), PHI that is linked based on the following list of 18 identifiers must be treated with special care:

  • Names
  • All geographical identifiers smaller than a state, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000
  • Dates (other than year) directly related to an individual
  • Phone numbers
  • Fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health insurance beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Vehicle identifiers and serial numbers, including license plate numbers;
  • Device identifiers and serial numbers;
  • Web Uniform Resource Locators (URLs)
  • Internet Protocol (IP) address numbers
  • Biometric identifiers, including finger, retinal and voice prints
  • Full face photographic images and any comparable images
  • Any other unique identifying number, characteristic, or code except the unique code assigned
    by the investigator to code the data

Where is your PHI?

Next, build a list of all of the places you store PHI. Here are common places we’ve seen at other clients:

  • Desktop computers
  • Laptop computers
  • Servers in your office
  • Servers at a vendor or off-site location
  • Emails you send internally
  • Emails you send externally
  • File sharing sites like Dropbox or Google Drive
  • Business applications like, electronic medical records, etc.
  • Mobile devices like iPhones, Androids, or tablets
  • Fax machines / Photocopiers / Scanners
  • Old school tech like pagers, dictation machines, etc.
  • File room(s) or Filing cabinets in hallways or people’s offices
  • Paper files stored off-site
  • Backup files on-site or off-site
  • USB / thumb drives
  • Medical devices (like x-ray machines, EKG, EEG, etc.)
  • In a website you run or someone runs on your behalf
  • In a database you run or someone runs on your behalf
  • Transcriptionist service
  • Billing service
  • Collections service
  • Hosted EMR / EHR provider
  • E-Prescriptions
  • Electronic Vaccine Records Exchanges
  • Hosted Email Service
  • Hosted Fax Service
  • Hosted Online Document Storage Service
  • IT company / person

What should you do next?

Get some free help!  Check out our free 42-Point Checklist for ways to make your practice HIPAA compliant.

Talk to us!

Have questions or feedback?  Please share them in the comments below.

Like this article?  Share it!

Do you think we might be a
good match?

We help over 100 of the best financial services, healthcare, and manufacturing companies across the U.S. with their cybersecurity.
Copyright 2024 Adelia Associates, LLC | All Rights Reserved