Which HIPAA Identifiers Map to PHI?

To map the 18 HIPAA Identifiers to Protected Health Information (PHI) in Spirion, you should use a combination of built-in AnyFinds and Sensitive Data Definitions (SDDs).

PHI is defined as any of these 18 identifiers when they are linked to health-related information (for example, a diagnosis, treatment, or billing record).

Mapping Table: 18 HIPAA Identifiers to Spirion Data Types

#	HIPAA Identifier	Spirion Data Type / AnyFind	Recommended SDD Logic
1	Names	`AnyFind: Name`	`Name NEAR Health Information`
2	Geographic subdivisions	`AnyFind: Personal Address`	`Address NEAR Health Information`
3	Dates (Birth, Discharge, etc.)	`AnyFind: Date of Birth`	`DOB NEAR Health Information`
4	Telephone numbers	`AnyFind: Telephone Number`	`Phone NEAR Health Information`
5	Fax numbers	`Custom Regex: Fax`	`Fax NEAR Health Information`
6	Email addresses	`AnyFind: E-Mail Address`	`Email NEAR Health Information`
7	Social Security numbers	`AnyFind: Social Security Number`	`SSN NEAR Health Information`
8	Medical record numbers	`Custom Regex: MRN`	`MRN NEAR Name`
9	Health plan beneficiary numbers	`Custom Regex: HICN / Insurance`	`Insurance NEAR Name`
10	Account numbers	`AnyFind: Bank Account Number`	`Bank NEAR Name`
11	Certificate/license numbers	`AnyFind: Drivers License`	`License NEAR Name`
12	Vehicle identifiers (VIN/Plate)	`Custom Regex: VIN`	`VIN NEAR Name`
13	Device identifiers/Serial numbers	`Custom Regex: Serial`	`Serial NEAR Name`
14	Web URLs	`Custom Regex: URL`	`URL NEAR Health Information`
15	IP addresses	`Custom Regex: IP Address`	`IP NEAR Health Information`
16	Biometric identifiers	`Custom Dictionary: Biometrics`	`Biometric NEAR Name`
17	Full-face photos/images	`ImageReadTool (OCR/Analysis)`	`Image contains Face + Name`
18	Any other unique identifier	`Custom Regex / SearchAPI`	`Unique ID NEAR Name`

How to Create an "Exact" PHI Mapping in Spirion Sensitive Data Platform

The "Context" Requirement: An identifier (like a Name) is only PHI if it is linked to health data. Use the AnyFind: Health Information as your primary "context" detector.
Build SDDs for High Accuracy: Create SDDs that require an identifier to be NEAR a medical term.
- Example: [AnyFind: Name] NEAR WITH DISTANCE (100) [AnyFind: Health Information]
Use Custom Dictionaries: For identifiers like Biometrics or Medical Record Numbers, create a custom dictionary or regex that matches your organization's specific formats.
Map to the "PHI" Label: In your Playbooks, any finding that triggers these SDDs should be automatically assigned the "PHI" or "Restricted - PHI" classification label.

Operational Tip: By mapping these 18 identifiers to a single "PHI" label, you can use the SPIGlass Dashboard to show a unified view of your HIPAA risk, rather than tracking 18 separate data types.

Which HIPAA Identifiers Map to PHI?

Mapping Table: 18 HIPAA Identifiers to Spirion Data Types

How to Create an "Exact" PHI Mapping in Spirion Sensitive Data Platform

Was this article helpful?