Compliance: Protected Health Information

Documentation
This topic is under construction for the 18.1 release of LabKey Server.

Administrators can mark columns as either Restricted, Full PHI, Limited, or non-PHI. LabKey Server does not dictate any behavior with respect to these fields. Individual applications determine how PHI levels are related to user access. This system allows administrators to control PHI assignments without actually viewing the data in the assigned columns.

Example PHI Levels

Typical PHI-level assignments for fields. The following table is provided only with the intent to make the PHI levels more vivid and easily understood. Assignments will vary for different applications and different contexts. These are not recommendations or rules for PHI assignments.

PHI LevelData Fields
RestrictedThe most sensitive categories of data. HIV status
Social Security Number
Credit Card Number
Full PHIAddress
Telephone Number
Clinical Billing Info
Limited PHIZIP Code
Partial Dates
Non-PHIHeart Rate
Lymphocyte Count

You can assign PHI level to columns using two different methods:

Use XML Metadata

You can mark columns as PHI in the schema definition XML file.

In the example below, the column DeathOrLastContactDate has been marked as "Limited":

<column columnName="DeathOrLastContactDate">
<formatString>Date</formatString>
<phi>Limited</phi>
</column>

Possible values are:

  • NotPHI
  • Limited
  • PHI
  • Restricted
The default value is NotPHI.

Custom modules can implement special Java class handlers of PHI levels.

Review the PHI XML Reference.

Discussion

previousnext
 
expand all collapse all