HIPAA PHI Baseline

Version

1.0.0

Category

Data boundaries

Evaluation Available

true

Domains

• HIPAA_PHI
• PCI
• SECURITY

Controls

• Email, phone, SSN, MRN-like and card-number patterns
• Six normalized instruction-override phrase heuristics
• Structured credential fields and known secret patterns

Docs

• Policies and validators
• Policy packs
• API reference

Thresholds

warn: 1

redact: 4

block: 8

escalate: 16

Behavior

• The exact assigned ID and version select scoring weights, thresholds and enabled validators.
• BLOCKED and ESCALATE_HITL withhold protected output. Required transformations are applied and revalidated at supported boundaries.
• HIPAA_PHI findings have domain weight 3; SECURITY findings have weight 2. A supported email finding can escalate under this configuration.

Limitations

• Pattern matching can produce false positives and miss sensitive data; it does not establish legal data classification.
• Pack names do not establish HIPAA, PCI DSS, accessibility or other regulatory compliance.
• A finding is not a completed remediation. Inspect the final enforcement outcome and returned artifact.
• Regulatory Pulse source coverage and draft state mappings do not establish installed jurisdiction-specific executable packs.
• Does not validate clinical correctness, lawful disclosure, a HIPAA security program or a business associate agreement.

Enabled validators

• pii-phi · 1.1.1
• prompt-injection · 1.2.0
• security-secrets · 1.1.0

Bounded examples

Request examples describe an exercise; they are not recorded execution evidence.

{"scenarioId":"hitl-input"}