---
title: "What Scan Playbook Actions are best for PHI in a HIPAA context?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-scan-playbook-actions-are-best-for-phi-in-a-hipaa-context"
language: "en"
last_updated: "2026-06-03T17:31:05.775Z"
---

# What Scan Playbook Actions are best for PHI in a HIPAA context?

For a robust PHI governance program, your Playbook actions should be tiered based on the risk level of the finding. In Spirion, actions are target-dependent (what works on a Windows endpoint may differ from M365), but the logic remains consistent.

Here are suggested Playbook actions for PHI, categorized by risk:

## 1\. Critical Risk Actions (e.g., SSN + Clinical Context)

For findings that represent a high probability of a HIPAA breach, use **Automatic Actions** to remove the data from the insecure location immediately.

-   **Quarantine / Move:** Automatically move the file to a secure, restricted-access "Quarantine" folder. This removes the risk while preserving the file for review.
-   **Shred (Use with Caution):** If the file is in a location where it should *never* exist (e.g., a public web server or a temp folder), use the Shred action to delete it permanently.
-   **Redact:** If using the **Private AI integration**, automatically redact the sensitive identifiers (like SSNs) while leaving the rest of the document intact.

## 2\. High Risk Actions (e.g., MRN + Name or Bulk PHI)

For data that is sensitive but may be part of a legitimate business process, use **Governance and Encryption** actions.

-   **Classify (Persistent):** Apply a **"PHI - Restricted"** label to the file metadata (M365) or NTFS ADS (Windows). This ensures the label "travels" with the file.
-   **MIP Labeling:** Apply a **Microsoft Information Protection (MIP)** label that triggers automated encryption (e.g., "Highly Confidential - PHI").
-   **Restrict Sharing:** For M365/OneDrive targets, use a playbook to remove "Anyone with the link" or "External" sharing permissions.

## 3\. Medium Risk / Operational Actions (e.g., Name + DOB)

For findings that require human verification or owner awareness, use **Notification and Workflow** actions.

-   **Notify Owner:** Send an automated email to the file owner with a link to the finding, asking them to confirm if the data is necessary and secure.
-   **Notify Privacy Team:** Send a summary alert to your Compliance or Privacy alias for any finding that triggers a high-confidence PHI SDD.
-   **Execute Script:** Trigger a custom PowerShell or Python script to log the finding into an external ticketing system (like Jira or ServiceNow) for tracking.

* * *

## Summary Playbook Configuration Table

| Trigger (SDD/Data Type) | Execution Mode | Primary Action | Secondary Action |
| --- | --- | --- | --- |
| **High-Confidence PHI SDD** | **Automatic** | **Quarantine** | Notify Privacy Team |
| **Bulk PHI (>50 records)** | **Automatic** | **MIP: Encrypt** | Notify Department Head |
| **MRN + Name** | **Automatic** | **Classify: PHI** | Notify File Owner |
| **General Health Info** | **Manual Review** | **Classify: Internal** | None (Wait for Review) |

## Operational Best Practices

-   **Test in "Notify Only" Mode:** When deploying a new PHI playbook, run it in "Notify Only" mode for 1-2 weeks to ensure your SDD logic isn't triggering on false positives before enabling "Quarantine" or "Shred."
-   **Check Permissions:** Ensure your **Search Agents** have the necessary "Write" or "Modify" permissions on the target systems to execute these actions.
-   **Monitor Action Success:** Use the **Reduction Metrics** in your dashboard to track "Action Attempted" vs. "Action Succeeded." If actions are failing, it is usually due to a permissions mismatch or a network path issue.

**Pro Tip:** In **v13.6**, ensure your **shipper\_queue** is healthy. If the queue is backed up, your "Automatic" actions will still run on the agent, but the "Success" status won't be reflected in the console until the results are shipped.