Protected Health Information (PHI) data handling covering the 18 HIPAA identifiers, de-identification methods (Safe Harbor, Expert Determination), minimum necessary principle, access controls, audit logging, encryption, and secure disposal.
allowed-tools
Read, Grep, Glob, Bash
PHI Data Handling
When to use
Determining whether a dataset or field constitutes PHI
Implementing Safe Harbor or Expert Determination de-identification
Designing role-based access controls for a clinical system
Configuring audit logging for PHI access events
Implementing encryption for PHI at rest or in transit
Planning media sanitization or cryptographic erasure of PHI
Core principles
When in doubt it's PHI — if a data element could identify an individual in combination with health information, treat it as PHI; the cost of over-protecting is low, the cost of a breach is not
Minimum necessary is enforced at the API layer — strip fields the caller's role doesn't need before the response leaves your service; don't rely on the client to ignore what it receives
Every PHI access gets a log entry — read access included, not just writes; audit trails without reads are half the story
Cryptographic erasure beats secure delete — destroying the encryption key is faster, more reliable, and more auditable than overwriting data in place
Break-glass access is not a loophole — it must be logged, time-limited, and reviewed post-access; emergency access that goes unreviewed is a compliance finding waiting to happen
Reference Files
references/identifiers-deidentification.md — the 18 HIPAA identifiers, Safe Harbor removal checklist, Expert Determination method and documentation requirements
