Education Center

Healthcare Data Protection Essentials

Understanding what constitutes protected information, how it can be compromised, and what your organization can do to maintain both compliance and patient trust.

Understanding Data

What Constitutes Protected Information?

Healthcare organizations handle multiple categories of sensitive data. Understanding the distinctions is critical for proper handling, storage, and transmission.

Protected Health Information (PHI)

Under HIPAA, PHI is any health information that can identify an individual and is created, received, maintained, or transmitted by a covered entity.

The 18 HIPAA Identifiers:

• Names • Geographic data • Dates (birth, admission) • Phone numbers • Fax numbers • Email addresses • Social Security numbers • Medical record numbers • Health plan numbers • Account numbers • Certificate numbers • Vehicle identifiers • Device identifiers • Web URLs • IP addresses • Biometric identifiers • Full-face photographs • Any unique identifier

Personally Identifiable Information (PII)

PII is broader than PHI and includes any information that can identify an individual. While HIPAA covers PHI, state laws and other regulations may protect PII more broadly.

Common PII in Healthcare:

• Employee records and payroll data • Vendor and business partner information • Financial and insurance records • Operational data with embedded identifiers • Marketing and communications lists

Key distinction: All PHI is PII, but not all PII is PHI.

Safe Harbor De-identification

HIPAA provides a Safe Harbor method for de-identifying PHI. If all 18 identifiers are removed, the information is no longer considered PHI.

Safe Harbor Method

Remove all 18 identifiers. No expertise required. Provides certainty that data is no longer PHI.

Expert Determination

Statistical or scientific expert certifies that the risk of re-identification is very small.

Compliance

What Violates HIPAA?

Understanding common violations helps organizations implement effective safeguards and training programs.

Minimum Necessary Standard

Accessing or disclosing more PHI than necessary. Looking up celebrity records out of curiosity, sharing full charts when only a diagnosis is needed.

Improper Disclosure

Sharing PHI with unauthorized individuals or through insecure channels. Discussing patients in public areas, sending PHI via unencrypted email.

Insufficient Access Controls

Shared passwords, lack of role-based access, terminated employees retaining system access, unlocked workstations in clinical areas.

Lack of Business Associate Agreements

Sharing PHI with vendors without proper contractual protections. Using cloud storage without BAA, third-party billing without agreements.

Inadequate Risk Analysis

No documented risk assessment, assessments not updated after system changes, ignoring identified vulnerabilities.

Insufficient Training

Workforce lacking awareness of policies and procedures. No phishing awareness, failure to report suspicious activity.

OCR Civil Penalty Structure

Tier 1
$137–$68K
Unaware of violation
Tier 2
$1.3K–$68K
Reasonable cause
Tier 3
$13K–$68K
Willful neglect, corrected
Tier 4
$68K–$1.9M
Willful neglect, not corrected

Per violation, per year. Criminal penalties may also apply for intentional wrongful disclosure.

AI Governance

Responsible AI Usage in Healthcare

Generative AI tools offer productivity benefits but introduce unprecedented data exposure risks.

✓ Acceptable Use (with BAA)

  • Microsoft Copilot with Healthcare Data Protection
  • OpenAI ChatGPT Enterprise with signed BAA
  • Google Cloud Vertex AI with data residency
  • Organization-approved clinical documentation tools
  • Internal AI systems with documented controls

Requirement: Signed BAA, disabled model training, audit logging, IT approval.

✗ Prohibited Use

  • Consumer ChatGPT, Claude, or Gemini for PHI content
  • Using AI to summarize or rewrite patient notes
  • Pasting diagnostic information or lab results
  • Uploading patient images or documents to AI tools
  • Using AI for coding or billing with identifiers

Risk: Data may be stored, used for model training, or accessed without your knowledge.

Training

What Staff Need to Know

Effective security awareness training transforms your workforce from a vulnerability into your first line of defense.

🔓

Password & Access Hygiene

Unique passwords for each system, multi-factor authentication, never sharing credentials, locking workstations when stepping away.

📨

Phishing Recognition

Identifying suspicious emails, verifying sender addresses, never clicking unknown links, reporting suspected phishing.

🗂

Physical Security

Clean desk policies, proper disposal of printed materials, securing portable devices, restricting patient conversations to private areas.

💻

Safe Data Handling

Using only approved applications, understanding cloud storage rules, proper use of encryption, reporting accidental disclosures.

🤖

AI Tool Awareness

Understanding which AI tools are approved, why consumer AI poses risks, how to de-identify content before using AI.

🚨

Incident Reporting

Recognizing potential security incidents, understanding the reporting chain, documenting what happened, knowing reporting is protected.

Need Help Implementing These Practices?

Velari provides customized security awareness training, policy development, and compliance program management tailored to your organization's size, specialty, and risk profile.