Which Sensitive Data Definitions (SDDs) Reduce PHI False Positives?

To reduce PHI false positives, you should use Sensitive Data Definitions (SDDs) that enforce contextual relationships and proximity.

In healthcare environments, a common false positive is "benign" data that looks like PHI (e.g., a list of names for a company softball team or a list of dates that aren't birthdays). SDDs eliminate these by requiring that a medical "signal" be found near a personal "identifier."

Here are the specific SDD patterns that effectively reduce PHI false positives:

1. The "Medical Context" SDD

Instead of flagging every Social Security Number or Name, this SDD only triggers when a medical term is found nearby.

Logic: (AnyFind: SSN OR AnyFind: Name) NEAR (Custom Dictionary: Medical_Terms OR AnyFind: Health Information)
Why it works: It distinguishes between a general list of people and a list of patients by requiring clinical context (e.g., "Diagnosis," "Patient," "Treatment," or specific ICD-10 codes) to be within a certain distance (e.g., 50 characters) of the identifier.

2. The "Identifier + MRN" SDD

Medical Record Numbers (MRNs) are high-signal but can sometimes look like random strings. Combining them with a known AnyFind increases confidence.

Logic: (Custom Regex: MRN_Pattern) NEAR (AnyFind: Name OR AnyFind: Date of Birth)
Why it works: An MRN pattern found in isolation might be a part number or invoice ID. When found near a Name or DOB, the probability that it is a HIPAA-regulated record increases significantly.

3. The "Validation & Checksum" SDD

Use SDDs to leverage the advanced validation logic built into Spirion's AnyFind engine.

Logic: (AnyFind: SSN [Validated]) AND (AnyFind: Health Information)
Why it works: By ensuring the SSN has passed a checksum validation before checking for medical context, you eliminate random 9-digit strings that aren't actually Social Security Numbers.

4. The "Exclusionary" SDD (Negative Logic)

You can use SDDs to ignore known false positive sources.

Logic: (AnyFind: Health Information) NOT NEAR (Keyword: "Sample" OR Keyword: "Template")
Why it works: Many healthcare environments have "Sample Patient" files or training templates that trigger PHI alerts. This SDD allows you to automatically suppress findings that contain specific "safe" keywords.

5. Proximity-Based "Linkable" SDD

HIPAA is concerned with "linkable" data. An SDD can define what "linked" means for your organization.

Logic: (AnyFind: Name) WITHIN 20 CHARACTERS OF (AnyFind: Date of Birth)
Why it works: A name on page 1 and a date on page 50 are likely unrelated. By setting a tight proximity (e.g., 20-50 characters), you ensure the data is actually part of a single record (like a form or a row in a spreadsheet).

Summary of Best Practices for PHI SDDs

Use Dictionaries: Create a custom dictionary of your organization's specific medical terms, department names, or doctor names to use as the "context" in your SDDs.
Leverage ICD-10 Codes: Use a regex or dictionary for ICD-10 codes as a mandatory requirement for a "High Risk PHI" SDD.
Test with "Softball Team" Data: Always test your SDDs against known benign lists (like employee directories) to ensure they don't trigger.

Operational Tip

Once you have tuned these SDDs, map them to your "PHI" Classification Label. This ensures that your Governance Dashboard reflects high-accuracy, high-signal risk rather than being cluttered with false positives.