Which Classification Labels are Best for HIPAA?

The best classification labels for a HIPAA-governed environment typically include:

1. Regulatory-Specific Labels (The "What")

These labels identify the specific type of regulated data found. They are essential for audit reporting and proving compliance with HIPAA and HITECH.

• PHI (Protected Health Information): The primary label for any data containing health-related identifiers.
• ePHI (Electronic Protected Health Information): Specifically for digital records subject to the HIPAA Security Rule.
• PII (Personally Identifiable Information): For data that contains identifiers (like SSN or DOB) but may not yet be linked to a medical record.
• PCI (Payment Card Industry): For patient billing and payment information, which often overlaps with PHI in healthcare environments.

2. Sensitivity-Based Labels (The "Risk Level")

These labels determine the "Action Ladder" or how the data should be handled by downstream controls (like encryption or DLP).

• Restricted / Highly Confidential: For files containing high-risk PHI (e.g., medical records, ICD-9/10 codes, or Social Security numbers).
• Confidential: For internal patient lists or insurance information.
• Internal Use Only: For non-sensitive business data that does not contain PHI but should not be public.

3. Data Type-Specific Labels (The "Detail")

Spirion's AnyFind and SDD (Sensitive Data Definition) technology can drive highly specific labels based on the exact identifiers found:

• Medical Record Number (MRN)
• Health Insurance Claim Number (HICN)
• ICD-9 / ICD-10 Codes
• Patient Name & Address
• Date of Birth (DOB)

Best Practices for HIPAA Labeling in Spirion

• Use Persistent Classification: Ensure your playbooks are configured to write these labels into the M365 metadata or NTFS Alternate Data Streams (ADS). This ensures the "PHI" label stays with the file if it is moved or emailed.
• Map to MIP Labels: If you use Microsoft Information Protection, map your Spirion "PHI" findings to a corresponding MIP Label (e.g., "Highly Confidential - PHI"). This allows Microsoft's native encryption to automatically protect the file.
• Automate the "Governed State": Use the Governance Dashboard to trace your "Classified vs. Unclassified" PHI. Your goal for HIPAA compliance is to have 100% of discovered PHI labeled and brought into a "governed" state.
• Combine Identifiers (SDDs): HIPAA often requires "linkable" information to be protected. Use Sensitive Data Definitions (SDDs) to apply a "PHI" label only when a Name is found in context with a Medical Record Number or Health Information. This reduces false positives and ensures your labels are high-signal.

Summary Recommendation

Start with a primary label of "PHI" or "Restricted - PHI" for any file containing HIPAA-regulated data types (SSN, MRN, ICD codes, etc.). This provides the clearest path for both internal reporting and external regulatory audits.