What Scan Playbook Actions are best for PHI in a HIPAA context?

For a robust PHI governance program, your Playbook actions should be tiered based on the risk level of the finding. In Spirion, actions are target-dependent (what works on a Windows endpoint may differ from M365), but the logic remains consistent.

Here are suggested Playbook actions for PHI, categorized by risk:

1. Critical Risk Actions (e.g., SSN + Clinical Context)

For findings that represent a high probability of a HIPAA breach, use Automatic Actions to remove the data from the insecure location immediately.

Quarantine / Move: Automatically move the file to a secure, restricted-access "Quarantine" folder. This removes the risk while preserving the file for review.
Shred (Use with Caution): If the file is in a location where it should never exist (e.g., a public web server or a temp folder), use the Shred action to delete it permanently.
Redact: If using the Private AI integration, automatically redact the sensitive identifiers (like SSNs) while leaving the rest of the document intact.

2. High Risk Actions (e.g., MRN + Name or Bulk PHI)

For data that is sensitive but may be part of a legitimate business process, use Governance and Encryption actions.

Classify (Persistent): Apply a "PHI - Restricted" label to the file metadata (M365) or NTFS ADS (Windows). This ensures the label "travels" with the file.
MIP Labeling: Apply a Microsoft Information Protection (MIP) label that triggers automated encryption (e.g., "Highly Confidential - PHI").
Restrict Sharing: For M365/OneDrive targets, use a playbook to remove "Anyone with the link" or "External" sharing permissions.

3. Medium Risk / Operational Actions (e.g., Name + DOB)

For findings that require human verification or owner awareness, use Notification and Workflow actions.

Notify Owner: Send an automated email to the file owner with a link to the finding, asking them to confirm if the data is necessary and secure.
Notify Privacy Team: Send a summary alert to your Compliance or Privacy alias for any finding that triggers a high-confidence PHI SDD.
Execute Script: Trigger a custom PowerShell or Python script to log the finding into an external ticketing system (like Jira or ServiceNow) for tracking.

Summary Playbook Configuration Table

Trigger (SDD/Data Type)	Execution Mode	Primary Action	Secondary Action
High-Confidence PHI SDD	Automatic	Quarantine	Notify Privacy Team
Bulk PHI (>50 records)	Automatic	MIP: Encrypt	Notify Department Head
MRN + Name	Automatic	Classify: PHI	Notify File Owner
General Health Info	Manual Review	Classify: Internal	None (Wait for Review)

Operational Best Practices

Test in "Notify Only" Mode: When deploying a new PHI playbook, run it in "Notify Only" mode for 1-2 weeks to ensure your SDD logic isn't triggering on false positives before enabling "Quarantine" or "Shred."
Check Permissions: Ensure your Search Agents have the necessary "Write" or "Modify" permissions on the target systems to execute these actions.
Monitor Action Success: Use the Reduction Metrics in your dashboard to track "Action Attempted" vs. "Action Succeeded." If actions are failing, it is usually due to a permissions mismatch or a network path issue.