{"id":5033,"date":"2017-11-10T19:28:34","date_gmt":"2017-11-10T19:28:34","guid":{"rendered":"https:\/\/www.n-able.com\/?p=5033"},"modified":"2021-03-31T19:33:48","modified_gmt":"2021-03-31T18:33:48","slug":"what-pii-and-phi-and-how-do-you-secure-them","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/what-pii-and-phi-and-how-do-you-secure-them","title":{"rendered":"What Is PII and PHI and How Do You Secure Them?"},"content":{"rendered":"

Even with the regular news stories about data breaches, I\u2019m still not sure our society views cybersecurity and cyberspace seriously enough. Many still entertain the notion that cyberspace is somehow removed from the physical world we live in, but there is nothing \u201cvirtual\u201d about this reality or the threats that exist here. Think about how cyberspace impacts our life. Where does the majority of our communication happen? Where is the information concerning our life and possessions stored? The records for our houses, our cars, etc.\u2014all the primary sources for these exist in cyberspace. That includes our money. Check out a bank statement. Do we really think there is physical \u201cmoney\u201d in a vault someplace? No, it\u2019s just binary code on a hard drive somewhere. Let\u2019s face it; if we were erased in cyberspace, our life in physical space would be miserable. We would have a hard time proving we have property, history, wealth, or even citizenship. That is why it is so important to secure the data we depend on. To that end, two acronyms we should know are PII and PHI.<\/p>\n

What does PII stand for?<\/b><\/p>\n

\"PII.jpg\"The definition of PII is personally identifiable information. This is information that, on its own or combined, can be used to identify, locate, or contact an individual. Some examples of PII are obviously sensitive: Social Security number, credit card number, driver\u2019s license number, and account numbers. Others are less obvious but just as important: full name, date of birth, home address, phone number, employment history, purchase history, email address, or even a photo of an individual\u2019s face. PII is legally protected by many state laws and good business practices.<\/p>\n

What does PHI stand for?<\/b><\/p>\n

\"healthdata.jpg\"The definition of PHI is protected health information. It is a subset of PII that is protected by the\u00a0HIPAA Privacy Act of 1996<\/a>. PHI is information that can be used to identify an individual AND that relates to that individual’s past, present, or future physical or mental health care or health care payments. Some examples of PHI are: any and all PII gathered in the course of providing health services, medical, dental, or prescription drug records, insurance coverage, health plan number, status in a government health program, and dates of hospitalization.<\/p>\n

While healthcare workers in the United States are bound by HIPAA, outside the US, there are similar frameworks for PII and PHI, such as the\u00a0UK Cyber Essentials<\/a>, Canada\u2019s\u00a0Management of Information Technology Security (MITS)<\/a>, and the\u00a0Australian Signals Directorate (ASD)<\/a>. Fines can be steep for violations. For HIPAA violations, the civil penalties for the unintentional yet inappropriate release of PHI range from $100 to $50,000 per violation, with up to a maximum of $1.5 million in a year. Individuals who intentionally obtain, disclose, or sell PHI for personal gain or malicious harm may incur criminal penalties including fines AND prison time up to 10 years.<\/p>\n

So how do we secure this PII and PHI knowing that a data breach can affect lives and even bring legal repercussions? First, our level of security must match the level of data sensitivity. In the case of PII, it depends on the business contract under which we are handling the PII and any applicable state laws. For any PII you handle, make sure you know your obligations! In the case of PHI, we know it is considered highly sensitive and so we need to use PHI security best practices.<\/p>\n

Cybersecurity best practices<\/b><\/p>\n

\"security.jpg\"Start out with the fundamentals (this is not an exhaustive list):<\/p>\n