---
title: "Which Sensitive Data Definitions (SDDs) Reduce PHI False Positives?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/which-sensitive-data-definitions-sdds-reduce-phi-false-positives"
language: "en"
last_updated: "2026-06-03T16:21:55.345Z"
---

# Which Sensitive Data Definitions (SDDs) Reduce PHI False Positives?

To reduce PHI false positives, you should use Sensitive Data Definitions (SDDs) that enforce contextual relationships and proximity.

In healthcare environments, a common false positive is "benign" data that looks like PHI (e.g., a list of names for a company softball team or a list of dates that aren't birthdays). SDDs eliminate these by requiring that a medical "signal" be found near a personal "identifier."

Here are the specific SDD patterns that effectively reduce PHI false positives:

## 1\. The "Medical Context" SDD

Instead of flagging every Social Security Number or Name, this SDD only triggers when a medical term is found nearby.

-   **Logic:** `(AnyFind: SSN OR AnyFind: Name) NEAR (Custom Dictionary: Medical_Terms OR AnyFind: Health Information)`
-   **Why it works:** It distinguishes between a general list of people and a list of *patients* by requiring clinical context (e.g., "Diagnosis," "Patient," "Treatment," or specific ICD-10 codes) to be within a certain distance (e.g., 50 characters) of the identifier.

## 2\. The "Identifier + MRN" SDD

Medical Record Numbers (MRNs) are high-signal but can sometimes look like random strings. Combining them with a known AnyFind increases confidence.

-   **Logic:** `(Custom Regex: MRN_Pattern) NEAR (AnyFind: Name OR AnyFind: Date of Birth)`
-   **Why it works:** An MRN pattern found in isolation might be a part number or invoice ID. When found near a Name or DOB, the probability that it is a HIPAA-regulated record increases significantly.

## 3\. The "Validation & Checksum" SDD

Use SDDs to leverage the advanced validation logic built into Spirion's AnyFind engine.

-   **Logic:** `(AnyFind: SSN [Validated]) AND (AnyFind: Health Information)`
-   **Why it works:** By ensuring the SSN has passed a checksum validation *before* checking for medical context, you eliminate random 9-digit strings that aren't actually Social Security Numbers.

## 4\. The "Exclusionary" SDD (Negative Logic)

You can use SDDs to ignore known false positive sources.

-   **Logic:** `(AnyFind: Health Information) NOT NEAR (Keyword: "Sample" OR Keyword: "Template")`
-   **Why it works:** Many healthcare environments have "Sample Patient" files or training templates that trigger PHI alerts. This SDD allows you to automatically suppress findings that contain specific "safe" keywords.

## 5\. Proximity-Based "Linkable" SDD

HIPAA is concerned with "linkable" data. An SDD can define what "linked" means for your organization.

-   **Logic:** `(AnyFind: Name) WITHIN 20 CHARACTERS OF (AnyFind: Date of Birth)`
-   **Why it works:** A name on page 1 and a date on page 50 are likely unrelated. By setting a tight proximity (e.g., 20-50 characters), you ensure the data is actually part of a single record (like a form or a row in a spreadsheet).

## Summary of Best Practices for PHI SDDs

-   **Use Dictionaries:** Create a custom dictionary of your organization's specific medical terms, department names, or doctor names to use as the "context" in your SDDs.
-   **Leverage ICD-10 Codes:** Use a regex or dictionary for ICD-10 codes as a mandatory requirement for a "High Risk PHI" SDD.
-   **Test with "Softball Team" Data:** Always test your SDDs against known benign lists (like employee directories) to ensure they don't trigger.

**Operational Tip**

Once you have tuned these SDDs, map them to your **"PHI" Classification Label**. This ensures that your **Governance Dashboard** reflects high-accuracy, high-signal risk rather than being cluttered with false positives.