What does a report for health information look like?

A Health Information (PHI/HIPAA) report in Spirion Sensitive Data Platform is designed to provide a comprehensive inventory of medical-related sensitive data to ensure compliance with regulations like HIPAA and HITECH.

Based on best practices and healthcare case studies a robust PHI report template should include the following sections and data points:

1. Executive Summary (The "Heat Map")

This section provides a high-level view for Risk Officers and Management.

Total PHI Findings: A count of all medical-related matches across the environment.
Risk by Department: A breakdown of where PHI is most concentrated (e.g., Billing, HR, Clinical Research).
Top Offenders: The specific endpoints or servers containing the highest volume of unprotected health data.

2. Core PHI Data Types (The "What")

Your template should specifically filter for and display these Spirion-defined Data Types:

Medical Record Numbers (MRN): Unique identifiers for patients.
Health Insurance Numbers: Policy and group IDs.
ICD-9 / ICD-10 Codes: International Classification of Diseases codes.
CPT Codes: Current Procedural Terminology codes.
Social Security Numbers (SSN): Often used as a secondary identifier in legacy health systems.
Patient Names & DOB: When found in proximity to medical codes.

3. Location & Context (The "Where")

This section helps IT and Security teams prioritize remediation.

Target Name: The server, endpoint, or cloud repository (for example, \\SharePoint\Clinical_Trials).
File Path / Mailbox: The exact location of the file or email.
File Type: Identifying if the data is in an Excel sheet (high risk), a scanned PDF (OCR match), or an email attachment.
Last Modified Date: Helps distinguish between active clinical data and stale, legacy archives.

4. Compliance & Remediation Status (The "Action")

This is the most important section for proving HIPAA compliance.

Classification Label: Shows if the file has been tagged as "Restricted" or "PHI."
Protection Status: Is the file encrypted, or is it "Unprotected"?
Remediation History: A log of actions taken (for example, "File Shredded," "Quarantined to Secure Server," or "Redacted").
False Positive Rate: A metric showing the accuracy of the scan to build trust with clinical staff.

Example Template Layout (Tabular View):

Target Name	File Path	Data Type Found	Match Count	Classification	Action Taken
`MED-SRV-01`	`\Billing\2023_Claims.xlsx`	ICD-10, MRN	450	Restricted	Quarantined
`LAPTOP-JDOE`	`C:\Users\jdoe\Desktop\Notes.txt`	SSN, Patient Name	12	Unlabeled	Shredded
`O365-Archive`	`Inbox\Old_Patient_Records.msg`	Insurance ID	85	Confidential	None (Pending)

Pro-Tip for Health Reports:

Use Proximity Searching: In your report configuration, prioritize results where a Patient Name is found within 50 characters of an MRN or ICD-10 code. This "Contextual PHI" is much higher risk than a random string of numbers.
Automate for Audits: Set this report to generate automatically every month and deliver it to your Privacy Officer. This creates a "defensible audit trail" required for HIPAA/HITRUST certifications.