PHI handling

Two different operations, applied in different places, for different reasons.

#Redaction and masking

Redaction: Deep replacement with [redacted], by declared field name, applied to anything persisted - run traces, logs, audit records. The value is gone.
Masking: Partial reduction for display - K. W., MRN-*****, *******0300. Enough to recognise a record, not enough to identify a person. Applied at the server, so the full value never reaches the browser at all and cannot be recovered from the page source or a screenshot.

By field name, everywhere

Redaction is applied by declared key across the whole object, not by listing the fields somebody remembered. An earlier version named a few fields inline and missed patient.firstName and subscriber.lastName. A later probe found a masked list view still returning full patient names and medical record numbers, because patientRef and mrn were simply not in the key set - the masking was working perfectly on the fields it knew about.

#The lesson that generalises

A leak test whose needles are hand-written tests the needles. The eval now derives them from the seed data itself, so a field added to a fixture is automatically a field the leak test looks for. It immediately found a second leak - groupNumber, a health plan beneficiary number and a safe-harbor identifier in its own right.

#Minimum necessary

A list view is a trigger, not a chart. ehr_find_encounters returns masked rows because nothing about deciding which encounters need attention requires an identifier. Unmasked access is a separate tool with a separate atom and its own audit event.

#Purpose of use

Every read of patient data records who made it, which record, and why - treatment, payment, or operations. Purpose is carried on the principal and written into the audit event; there is no unattributed read.

#In the interface

Masked values are rendered deliberately differently from real ones - a distinct colour, a dotted underline, and an explanation on hover. Someone reading a screen of K. W. should never have to wonder whether that is the data or a rendering artefact, and a real identifier should never be mistaken for a mask.

#Eligibility is a disclosure

Asking a payer whether a member needs authorization discloses that member to the payer. It is a legitimate treatment and payment activity, so it is not gated - a human approving every lookup buys nothing and pushes the work back to the fax machine it replaced. It is bounded and audited instead, because the risk there is volume, not any single call.