Privacy, De-identification & Data Governance

Protected health information (PHI) = individually identifiable health information held by a covered entity (provider, health plan, clearinghouse) or its business associate. Analysts handle PHI daily, so they must: • use only approved tools and storage (never personal email, laptops or public AI tools), • follow 'minimum necessary' — only the fields needed, • share outputs appropriately (aggregate when possible), • report any suspected breach immediately.