PHI Detection Rules

๐Ÿšง

Beta Functionality

The functionality described in this section is in beta. To enable it on your Nightfall instance, [contact Nightfall support])https://nightfall.ai/support

Protected health information (PHI), also referred to as personal health information, describes a patient's medical history โ€” including ailments, various treatments, and outcomes. PHI may include:

  • demographic information
  • test and laboratory results
  • mental health conditions
  • insurance information

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is the primary law that oversees the use of, access to, and disclosure of PHI in the United States. HIPAA lists 18 different personal information identifiers (HIPAA PII) that, when paired with health information, become PHI.
In order to more accurately detect potential PHI, Nightfall has introduced specific new Detectors that allow for specialized combinations of criteria.

These HIPPA PII and PHI specific Detectors intelligently aggregate Nightfall's built in detector to ensure compliance with governing law. For example, finding a patient's name in a document or message is not considered HIPAA PII as it does not uniquely identify an individual, many people can share the same name. However, the information would be considered HIPAA PII if the patient's name and address were in the same message.

Specific PHI and HIPAA PII can be detected with greater confidence, especially as they relate to specific medical codes or terms in association with specific logical combinations of other PII.
For instance when the patient's name and date of birth or a person's name and street address or any of a set of particular PII (phone number email, SSN, etc) it would be considered HIPAA PII.

Combination of PII that are considered HIPAA PIICombination of PII that are considered HIPAA PII

Combination of PII that are considered HIPAA PII

If the combined detectors all match with a confidence of "Very Likely" it would match our "HIPAA PII Very Likely" Detection Rule. Otherwise if these detectors match with a confidence of "Likely" it would match our "HIPAA PII Likely" Detection Rule.

Alternatively when any of the above PII options are found in conjunction with a specific set of medical related codes or terms (IDC Codes, FDA Drug Names or Codes, Procedures), that finding could be flagged as PHI.

Combination of PII that could be considered PHICombination of PII that could be considered PHI

Combination of PII that could be considered PHI

When all the detectors within these PHI Detection Rules make findings that have a confidence of "Very Likely," that would match our "PHI Very Likely" Detection Rule, while if some are all are met with a confidence of "Likely" that would match our "PHI Likely" Detection Rule.

Our PHI Detectors may be used just like other Detectors with Policies or Inline Detection Rules.