In November 2024, a company called Serviceaide discovered that patient data from six western New York hospitals had been publicly exposed on the web for seven weeks. The breach affected 483,000 patients. The exposed data included names, Social Security numbers, medical record numbers, diagnoses, and treatment information.
Serviceaide provides AI-based IT management software. One of their healthcare clients, Catholic Health, had trusted them to handle PHI. The exposure wasn't a sophisticated attack. It was a configuration error that left protected health information accessible to anyone who knew where to look.
This is how HIPAA violations typically happen. Protected Health Information accumulates across systems, documents, and workflows. Organizations don't always know where it lives. When they share documents, process them through AI tools, or send them to vendors, PHI travels along without appropriate safeguards.
Finding PHI before it leaks requires understanding what HIPAA protects and deploying systematic detection. Here's how it works.
The short version: If you need to redact sensitive documents before they reach AI systems, PaperVeil handles that layer. The rest of this article explains where it fits in the broader governance architecture.
What HIPAA Actually Protects
Protected Health Information under HIPAA is individually identifiable health information held or transmitted by a covered entity or business associate. The key is the combination: health information plus identifiers that link to an individual.
The 18 HIPAA Identifiers
HIPAA's Safe Harbor method specifies 18 categories of identifiers that must be removed for data to be considered de-identified:
- Names (full name, first name, last name, maiden name, alias)
- Geographic data smaller than a state (street address, city, county, ZIP codes except the first three digits)
- Dates except year (birth date, admission date, discharge date, death date, and all ages over 89)
- Phone numbers (all telephone numbers)
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers (VINs, license plate numbers)
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers (fingerprints, voiceprints)
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic, or code
These identifiers become PHI when combined with health information. A name alone isn't PHI. A name associated with a diagnosis is.
Where PHI Hides
PHI appears across healthcare documents in predictable and unpredictable places:
Clinical notes. Free-text clinical documentation contains dense PHI: patient names, dates of service, diagnoses, treatment plans, medications, and references to family members. Unstructured text poses the biggest detection challenge.
Medical records. Structured records contain fields explicitly designed to capture PHI: patient demographics, medical record numbers, insurance information, visit histories.
Insurance forms. Claims, explanations of benefits, prior authorizations all contain patient identifiers combined with health information.
Lab reports. Results are linked to patients through identifiers and contain diagnostic information.
Imaging files. DICOM images from X-rays, MRIs, and CT scans contain embedded metadata with patient identifiers, plus the images themselves may include identifying information.
Administrative documents. Correspondence, scheduling records, billing documents all reference patients and their health information.
Communications. Emails, secure messages, and care coordination documents contain PHI in headers, body text, and attachments.
Beyond Traditional Healthcare
PHI also appears outside traditional healthcare settings:
HR departments maintain health insurance enrollment, FMLA documentation, disability accommodations, and workers' compensation records.
Insurance companies handle claims, coverage determinations, and appeals that contain PHI from their members.
Legal firms involved in healthcare litigation, medical malpractice, or disability cases handle extensive PHI in discovery materials.
Research organizations working with health data must de-identify before publication or sharing.
Any entity receiving PHI becomes a business associate with HIPAA obligations.
How PHI Detection Works
Effective PHI detection requires multiple techniques because health information appears in varied formats and contexts:
Pattern Matching for Structured Identifiers
Regular expressions and pattern matching identify structured PHI:
Medical record numbers follow organization-specific formats (length, prefix patterns, check digits).
Health plan identifiers follow payer-specific patterns for member IDs, group numbers, and policy numbers.
Dates in various formats (MM/DD/YYYY, DD-Mon-YY, natural language dates).
SSNs, phone numbers, addresses follow standard patterns but require context to distinguish from non-PHI uses.
Pattern matching is fast and reliable for well-formatted data. It fails on variations and cannot detect entities without consistent structure.
Named Entity Recognition for Clinical Text
NER models trained on clinical text identify PHI in unstructured documentation. Healthcare-specific models outperform general-purpose NER because they understand:
Clinical terminology. Medical terms, abbreviations, and jargon that general models don't recognize.
Healthcare context. Whether "John" refers to a patient, provider, or family member based on surrounding text.
Document structure. Common patterns in clinical notes (HPI, assessment, plan sections) that help locate identifiable information.
Leading healthcare NER models include:
John Snow Labs Spark NLP claims 99%+ accuracy on clinical text de-identification, with models specifically trained on healthcare documentation.
Amazon Comprehend Medical provides pre-trained models for extracting PHI from clinical text at approximately $10 per million characters.
Microsoft Presidio offers open-source PHI detection with pluggable recognizers for healthcare contexts.
NLM Scrubber from the National Library of Medicine provides Safe Harbor compliant detection specifically for biomedical text.
DICOM-Specific Detection
Medical imaging files require specialized handling:
Metadata extraction. DICOM headers contain patient names, IDs, dates, and facility information in standardized fields.
Pixel analysis. Images may contain burned-in patient information (name, date, facility) that must be detected and masked.
Structured reports. DICOM files can contain embedded text reports with PHI throughout.
Tools like John Snow Labs Visual NLP combine metadata cleaning, PHI-aware NER, and pixel masking for end-to-end DICOM de-identification.
Context-Aware Detection
Context determines whether information constitutes PHI:
Provider vs. patient names. Clinical notes mention both. Detection must distinguish which names require protection.
Historical vs. current information. Past dates may or may not require protection depending on regulatory interpretation.
De-identified references. Mentions of conditions without patient identifiers don't require protection.
Context-aware detection uses surrounding text, document structure, and semantic understanding to make appropriate classification decisions.
Building a PHI Detection Pipeline
Healthcare organizations need systematic detection across document types:
Stage 1: Document Ingestion
Handle healthcare-specific formats:
- HL7/FHIR messages containing structured clinical data
- CDA documents with combined structured and narrative content
- DICOM images with embedded metadata and pixel data
- PDF reports requiring text extraction and image analysis
- Scanned documents requiring OCR processing
- Email and attachments with mixed content types
Each format requires appropriate parsing before PHI detection can apply.
Stage 2: Detection Execution
Apply multiple detection methods:
Pattern matching for structured identifiers (MRNs, SSNs, dates, phone numbers).
NER models for names, addresses, and contextual identifiers in free text.
DICOM analysis for metadata fields and burned-in pixel data.
Checksum validation to reduce false positives on structured data.
Run detection comprehensively. Missing a single identifier in a document leaves the entire record identifiable.
Stage 3: Classification and Scoring
Categorize findings:
- Identifier type (which of the 18 HIPAA categories)
- Confidence level (high/medium/low based on detection method and context)
- Location (page, field, character position for audit purposes)
- Risk assessment (based on identifier type and surrounding health information)
Classification guides downstream handling decisions.
Stage 4: Action
Based on detection results:
De-identification replaces or removes identifiers according to Safe Harbor requirements. All 18 identifier types must be addressed for data to be de-identified.
Quarantine holds documents with PHI for review before sharing or processing.
Alerting notifies appropriate personnel when PHI is found in unexpected locations.
Logging maintains audit trails of detection activity for compliance documentation.
Stage 5: Validation
Verify de-identification effectiveness:
Spot-check samples to confirm detection accuracy.
Expert review for high-risk documents or novel content types.
Re-scan processed documents to confirm identifiers were removed.
Maintain statistics on detection performance for continuous improvement.
Real-World Detection Challenges
Healthcare environments present unique obstacles:
Clinical Note Complexity
Clinical notes aren't like other documents. Physicians use abbreviations, shorthand, and local conventions that vary by specialty, institution, and even individual clinician.
"Pt seen in ED, dx CHF exacerbation, d/c home on Lasix 40mg BID" contains diagnosis information (CHF exacerbation) that creates PHI when combined with identifiers elsewhere in the document. Detection must understand medical abbreviations and recognize health information in context.
Multi-System Data Flows
Healthcare organizations typically operate multiple systems: EHRs, billing platforms, scheduling systems, patient portals, referral networks. PHI flows between these systems, sometimes losing context about what protections apply.
A patient name might be PHI in a clinical note but not in a staff directory. Detection systems must understand the context in which identifiers appear, not just find patterns that match identifier formats.
Vendor and Partner Sharing
Healthcare operates through extensive partnerships: billing companies, transcription services, consulting providers, research collaborators. Each data sharing relationship creates potential PHI exposure.
Before documents leave your organization, detection must confirm that PHI has been appropriately handled. Business associate agreements establish legal requirements. Detection establishes technical compliance.
Legacy Format Handling
Healthcare generates diverse document formats. Scanned paper records require OCR before text analysis. Old system exports may use proprietary formats. Faxed documents (yes, healthcare still relies heavily on fax) combine image quality issues with text extraction challenges.
Detection pipelines must handle these legacy formats while maintaining accuracy standards.
Optimizing Detection Accuracy
PHI detection requires balancing sensitivity and specificity:
Reducing Missed PHI (False Negatives)
Missed identifiers leave data identifiable and at risk:
Train on representative data. Detection models trained on clinical text from your organization perform better than generic models.
Handle variations. Dates appear in many formats. Names have nicknames and abbreviations. MRNs vary by system.
Check all locations. Headers, footers, embedded images, metadata fields all contain PHI.
Process incrementally. Multiple passes with different detection methods catch what single methods miss.
Reducing False Positives
Excessive false positives create operational burden:
Use context. "John Hancock signature" isn't a patient name. Context analysis distinguishes legitimate matches.
Validate structured data. Check digits on identifiers reduce false matches on random numbers.
Tune thresholds. Adjust confidence thresholds based on use case requirements.
Allow human review. For critical applications, flag uncertain matches for expert decision.
HIPAA Compliance Considerations
Detection supports but doesn't guarantee compliance:
Safe Harbor Requirements
For data to be de-identified under Safe Harbor:
- All 18 identifier types must be removed
- The organization must have no actual knowledge that remaining information could identify individuals
Detection accuracy must be very high. Missing a single name or date leaves the entire record as PHI.
Expert Determination Alternative
Some organizations use statistical methods to demonstrate minimal re-identification risk. This approach requires a qualified expert and may allow retention of some information that would be removed under Safe Harbor.
Documentation Requirements
Maintain records of:
- Detection methods and tools used
- Accuracy validation results
- De-identification procedures
- Audit trails of processed documents
Documentation demonstrates due diligence if questions arise about PHI handling.
Business Associate Obligations
Organizations processing PHI for healthcare entities are business associates with independent HIPAA obligations. Detection capabilities are part of the required safeguards.
The Detection Imperative
The average healthcare data breach costs $9.48 million according to IBM. HIPAA penalties can reach $1.9 million per violation category, per year. Class action lawsuits follow major breaches. And the reputational damage affects patient trust and business relationships.
PHI detection is the foundation of protection. You cannot de-identify data you haven't scanned. You cannot prevent PHI transmission if you don't know what documents contain it. You cannot demonstrate HIPAA compliance without systematic detection capabilities.
Modern detection combines pattern matching, healthcare-trained NER models, and DICOM-specific analysis to find PHI across clinical and administrative documents. The technology has matured. Leading tools claim 99%+ accuracy on clinical text.
The question for healthcare organizations and their business associates isn't whether detection technology works. It's whether they've deployed it systematically across their document workflows, applied it before AI processing or external sharing, and documented the process for compliance purposes.
The organizations that find PHI before it leaks avoid becoming the next breach headline.
PaperVeil combines healthcare-trained detection with automated redaction for PHI protection. Find names, dates, medical record numbers, and all 18 HIPAA identifier types in clinical and administrative documents. Simple drag-and-drop processing with audit trails for compliance documentation. The detection layer that finds health information before HIPAA violations occur.