healthcare-phi-compliance

Patterns for protecting patient data, clinician data, and financial data in healthcare applications. Applicable to HIPAA (US), DISHA (India), GDPR (EU), and general healthcare data protection. Healthcare data protection operates on three layers: classification (what is sensitive), access control (who can see it), and audit (who did see it). PHI (Protected Health Information) — any data that can identify a patient AND relates to their health: patient name, date of birth, address, phone, email, national ID numbers (SSN, Aadhaar, NHS number), medical record numbers, diagnoses, medications, lab results, imaging, insurance policy and claim details, appointment and admission records, or any combination of the above. PII (Non-patient-sensitive data) in healthcare systems: clinician/staff personal details, doctor fee structures and payout amounts, employee salary and bank details, vendor payment information. Every PHI access or modification must be logged: Error messages: Never include patient-identifying data in error messages thrown to the client. Log details server-side only. Console output: Never log full patient objects.