Product Update: PHI Classification

Protected Health Information (PHI) is some of the most sensitive data an organization can hold, and it’s also some of the most complex to classify. This week, we released new PHI classification capabilities inside the MIND platform, helping our customers detect, distinguish and act on PHI with more clarity and precision than ever before.

Unlike traditional identifiers like social security numbers or credit card data, PHI is not always a single, standardized field. Instead, PHI is often a combination of personal identifiers and medical context, and that context is everything.

• A name on its own? → PII
• A name with a lab result? → PHI

That distinction is subtle but critical, especially in regulated industries. Add to that the challenge that PHI can appear across formats and systems: in emails, HR files, shared drives, PDFs, EHR exports and even Slack. And because every healthcare system formats medical record numbers differently, with their own prefixes, lengths and conventions, creating a classifier that works across environments without generating noise is uniquely difficult.

PHI isn’t just a concern for hospitals or healthcare providers. With this new classification capability, we’re identifying PHI across a wide range of industries, from financial services and insurance to retail and tech. Sensitive health-related data often surfaces in unexpected places, like employee records, support tickets or internal messaging platforms. Our classifier allows organizations to uncover and manage PHI even if they aren’t in a regulated healthcare environment. This means that businesses once unaware of their PHI exposure can now detect it, define policies around it and take action to prevent sensitive health data from leaking or being mishandled.

To address this, we built PHI classification from the ground up by researching how different health systems structure medical record numbers, collecting public datasets and collaborating with customers to understand real-world formats, and training our engine to identify not just keywords but the relationships between personal identifiers and medical data.

The result is a new PHI classification capability that recognizes medical record numbers, claims data, diagnostic imaging, electronic health records and more with high precision, reduces false positives and gives customers the ability to:

• Differentiate PHI from PII across dashboards and policies
• Filter, detect and act on PHI with more confidence
• Find and monitor PHI across all the environments it may live in

We also made it easy to build policies specific to PHI, whether to block, alert or educate, and to distinguish PHI exposure events from broader data incidents.

MIND brings everything together, discovery, classification, policy enforcement and remediation, into one unified platform. That means organizations can define and enforce PHI-specific policies, track issues across systems and respond faster with less effort. No switching tools. No stitching together workflows. Just one clear, automated way to keep sensitive health data safe, everywhere it lives.

This release is just the beginning. We’re actively expanding our PHI taxonomy to include imaging data, diagnosis codes, billing and claims information and other health-related identifiers required for HIPAA compliance and healthcare workflows.

With every update, we’re aiming for the same outcome: to help our customers confidently detect and prevent the leakage of sensitive health information, wherever it lives.

Now you can confidently keep your PHI data safe, no matter where it lives or how it moves.