---
title: "Which Classification Labels are Best for HIPAA?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/which-classification-labels-are-best-for-hipaa"
language: "en"
last_updated: "2026-06-03T16:18:20.897Z"
---

# Which Classification Labels are Best for HIPAA?

For HIPAA compliance, classification labels should be designed to clearly identify Protected Health Information (PHI) and its associated risk levels. Spirion recommends a multi-layered labeling strategy that combines regulatory categories with organizational sensitivity levels.

The best classification labels for a HIPAA-governed environment typically include:

## 1\. Regulatory-Specific Labels (The "What")

These labels identify the specific type of regulated data found. They are essential for audit reporting and proving compliance with HIPAA and HITECH.

-   **PHI (Protected Health Information):** The primary label for any data containing health-related identifiers.
-   **ePHI (Electronic Protected Health Information):** Specifically for digital records subject to the HIPAA Security Rule.
-   **PII (Personally Identifiable Information):** For data that contains identifiers (like SSN or DOB) but may not yet be linked to a medical record.
-   **PCI (Payment Card Industry):** For patient billing and payment information, which often overlaps with PHI in healthcare environments.

## 2\. Sensitivity-Based Labels (The "Risk Level")

These labels determine the "Action Ladder" or how the data should be handled by downstream controls (like encryption or DLP).

-   **Restricted / Highly Confidential:** For files containing high-risk PHI (e.g., medical records, ICD-9/10 codes, or Social Security numbers).
-   **Confidential:** For internal patient lists or insurance information.
-   **Internal Use Only:** For non-sensitive business data that does not contain PHI but should not be public.

## 3\. Data Type-Specific Labels (The "Detail")

Spirion's **AnyFind** and **SDD** (Sensitive Data Definition) technology can drive highly specific labels based on the exact identifiers found:

-   **Medical Record Number (MRN)**
-   **Health Insurance Claim Number (HICN)**
-   **ICD-9 / ICD-10 Codes**
-   **Patient Name & Address**
-   **Date of Birth (DOB)**

* * *

## Best Practices for HIPAA Labeling in Spirion

-   **Use Persistent Classification:** Ensure your playbooks are configured to write these labels into the **M365 metadata** or **NTFS Alternate Data Streams (ADS)**. This ensures the "PHI" label stays with the file if it is moved or emailed.
-   **Map to MIP Labels:** If you use Microsoft Information Protection, map your Spirion "PHI" findings to a corresponding **MIP Label** (e.g., "Highly Confidential - PHI"). This allows Microsoft's native encryption to automatically protect the file.
-   **Automate the "Governed State":** Use the **Governance Dashboard** to trace your "Classified vs. Unclassified" PHI. Your goal for HIPAA compliance is to have 100% of discovered PHI labeled and brought into a "governed" state.
-   **Combine Identifiers (SDDs):** HIPAA often requires "linkable" information to be protected. Use **Sensitive Data Definitions (SDDs)** to apply a "PHI" label only when a Name is found *in context* with a Medical Record Number or Health Information. This reduces false positives and ensures your labels are high-signal.

## Summary Recommendation

Start with a primary label of **"PHI"** or **"Restricted - PHI"** for any file containing HIPAA-regulated data types (SSN, MRN, ICD codes, etc.). This provides the clearest path for both internal reporting and external regulatory audits.