What Sensitive Data Definitions (SDDs) Catch High-risk PHI?

To catch high-risk PHI, you should use Sensitive Data Definitions (SDDs) that combine direct identifiers (like SSNs or MRNs) with clinical context (like ICD-10 codes or medical terms). These SDDs are designed to identify "true" PHI while filtering out general PII or benign data.

Here are the most effective Sensitive Data Definitions (SDDs) patterns for high-risk PHI:

1. The "Clinical Link" SDD (Highest Signal)

This is the gold standard for high-risk PHI. It requires a direct identifier to be physically near a medical diagnosis or treatment term.

Logic: [AnyFind: Social Security Number] NEAR WITH DISTANCE (100) [Custom Dictionary: Clinical_Keywords]
Clinical Keywords: Include terms like Diagnosis, Prognosis, Treatment, Patient, ICD-10, Clinic, Physician.
Why it works: It ensures the SSN is actually part of a medical record rather than a payroll or HR file.

2. The "Medical Record Number (MRN)" SDD

MRNs are high-risk because they are the primary key to a patient's history. Since MRN formats vary by hospital, use a custom regex combined with a name.

Logic: [Custom Regex: MRN_Pattern] NEAR WITH DISTANCE (50) [AnyFind: Name]
Why it works: An MRN pattern alone might be a part number. When found near a Name, the probability of it being a patient record is extremely high.

3. The "Diagnosis Code" SDD

ICD-10 codes are unambiguous clinical indicators. Combining them with a person's identity creates a high-risk finding.

Logic: [Custom Regex: ICD-10_Pattern] NEAR WITH DISTANCE (100) ([AnyFind: Name] OR [AnyFind: Date of Birth])
Why it works: This identifies files where a specific medical condition is linked to a specific individual, which is a core HIPAA violation if exposed.

4. The "Bulk PHI" SDD

High-risk often correlates with volume. Use this SDD to identify databases or spreadsheets containing many patient records.

Logic: [AnyFind: Health Information] GREATER THAN (10)
Why it works: A single mention of a medical term might be an email. Ten or more mentions in one file usually indicates a patient list or medical report, which is a much higher risk profile.

5. The "Insurance & Identity" SDD

Health Insurance Claim Numbers (HICN) or Member IDs are high-risk for billing fraud.

Logic: [Custom Regex: Insurance_ID] NEAR WITH DISTANCE (50) [AnyFind: Social Security Number]
Why it works: This catches the "Identity Theft" scenario where both a person's government ID and their medical insurance ID are exposed together.

Recommended Playbook Actions for High-Risk SDDs

SDD Trigger	Recommended Action	Classification Label
Clinical Link (SSN + Context)	Quarantine & Notify Privacy Team	`PHI - Restricted`
MRN + Name	Encrypt & Classify	`PHI - Restricted`
Bulk PHI (>10 records)	Move to Secure Share	`PHI - Bulk / High Risk`
ICD-10 + Identity	Redact (if possible) or Quarantine	`PHI - Clinical`

Operational Tip: In v13.6, use these SDDs to drive your Dashboard views. By filtering for these specific high-risk SDDs, you can provide leadership with a "True Risk" view that is separate from the "noise" of general PII discovery.