HIPAA PHI De-Identification for Enterprise Healthcare
300+
tables and files with patient data masked
Billions
of patient records masked
On time
and within budget
The client
A healthcare company that serves thousands of home-based members and has more than $1 billion in yearly revenue. Its applications run on Oracle and AS400 (iSeries), with data in DB2 databases and flat files.
The problem
Protected health information (PHI) had to be masked in development and test copies to meet HIPAA privacy rules, across billions of rows.
Earlier searches for sensitive records had given patchy results.
The masking guidelines were vague, so the work needed careful analysis and training.
Deadlines were tight and the older systems were complex.
What we did
Profiled and masked more than 300 tables and files that hold PHI, in several formats.
Masked billions of patient records in Oracle and AS400, and fixed inconsistencies along the way.
Built masking methods for the limits of AS400, including performance and key field issues.
Trained the client's team and handed over best practices, setup details and workflow guides.
Package: Dev and Test Privacy Process
The result
All PHI in the critical schemas and files named in the HIPAA requirements was masked.
Testing and development kept running while the deadlines were met.
Delivered on time and within budget, with handover support and documentation.
Tools and systems
Oracle, AS400 (iSeries), DB2 databases and flat files.