PHI/PII Handling Model

Overview

Healthcare AI evaluation inherently involves sensitive patient data. Akhara implements defense-in-depth protections for Protected Health Information (PHI) and Personally Identifiable Information (PII) throughout the data lifecycle.

Akhara is designed to HIPAA requirements; the compliance program and BAA process are in progress. A Business Associate Agreement (BAA) is required before processing PHI. Contact [email protected] for current BAA status.

Data Classification

PHI Categories

Category	Examples	Sensitivity
Direct Identifiers	Name, SSN, MRN, phone, email, address	Critical
Indirect Identifiers	DOB, ZIP, dates of service	High
Clinical Data	Diagnoses, medications, vitals, notes	High
Genetic/Biometric	DNA, fingerprints, voice prints	Critical
Images	Photos, X-rays, pathology	High

PII Categories

Category	Examples	Treatment
Direct PII	Name, email, phone	De-identify
Quasi-Identifiers	Age, gender, location	Generalize
Behavioral	Usage patterns, preferences	Anonymize

PHI Detection Pipeline

Detection Methods

Regex Pattern Matching

Fast detection of structured identifiers:

Pattern	Example	Precision
SSN	`\d{3}-\d{2}-\d{4}`	99%
Phone	`\(\d{3}\) \d{3}-\d{4}`	98%
Email	RFC 5322 pattern	99%
MRN	Client-specific patterns	95%
Date	Multiple formats	90%

# Example patterns
patterns = {
    "SSN": r"\b\d{3}-\d{2}-\d{4}\b",
    "PHONE": r"\b\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b",
    "EMAIL": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
    "DATE": r"\b\d{1,2}[/-]\d{1,2}[/-]\d{2,4}\b"
}

NER Model Detection

ML-based detection for unstructured text:Model: Fine-tuned Clinical BERT on i2b2/n2c2 datasetsEntity Types:

PERSON - Patient and provider names
LOCATION - Addresses, facilities
DATE - Dates of service, DOB
ID - MRN, account numbers
CONTACT - Phone, fax, email
AGE - Patient age mentions

# Detection example
text = "John Smith, DOB 03/15/1965, was seen at Main St Clinic"

entities = phi_detector.detect(text)
# [
#   {"text": "John Smith", "type": "PERSON", "start": 0, "end": 10},
#   {"text": "03/15/1965", "type": "DATE", "start": 16, "end": 26},
#   {"text": "Main St Clinic", "type": "LOCATION", "start": 40, "end": 54}
# ]

Image PHI Detection

For DICOM and clinical images:

Burned-in annotations: OCR detection of text overlays
DICOM headers: Automatic tag scanning
Face detection: For photos with patient faces

# DICOM PHI tags scanned
PHI_DICOM_TAGS = [
    (0x0010, 0x0010),  # Patient Name
    (0x0010, 0x0020),  # Patient ID
    (0x0010, 0x0030),  # Patient Birth Date
    (0x0010, 0x1000),  # Other Patient IDs
    (0x0008, 0x0080),  # Institution Name
    (0x0008, 0x0081),  # Institution Address
    # ... 50+ additional tags
]

De-identification Options

De-identification Modes

Mode	Description	Use Case
None	PHI preserved as-is	BAA in place, full data needed
Redact	Replace PHI with `[REDACTED]`	When PHI not needed for eval
Pseudonymize	Replace with consistent fake data	When relationships matter
Generalize	Reduce precision (age → age range)	Statistical analysis

Configuration

# Configure de-identification per project
client.projects.update(
    project="patient-triage",
    
    phi_config={
        "mode": "pseudonymize",
        
        "rules": {
            # Names → Consistent fake names
            "PERSON": {
                "method": "pseudonymize",
                "preserve_format": True
            },
            
            # Dates → Shift by random offset
            "DATE": {
                "method": "date_shift",
                "max_shift_days": 365,
                "preserve_relationships": True
            },
            
            # Ages → Generalize to ranges
            "AGE": {
                "method": "generalize",
                "buckets": [[0, 17], [18, 44], [45, 64], [65, 89], [90, 120]]
            },
            
            # Locations → Redact
            "LOCATION": {
                "method": "redact"
            },
            
            # Direct IDs → Hash
            "ID": {
                "method": "hash",
                "salt": "project_specific_salt"
            }
        },
        
        "always_detect": True,
        "log_detections": True
    }
)

De-identification Example

Original Text:

John Smith (DOB: 03/15/1965, MRN: 12345678) presented to 
Main Street Clinic on 01/10/2025 with chest pain. 
Dr. Sarah Johnson ordered an EKG.

Pseudonymized:

Robert Chen (DOB: 07/22/1964, MRN: [HASH:a3f2b1]) presented to 
[REDACTED] on 05/18/2024 with chest pain. 
Dr. Emily Martinez ordered an EKG.

Encryption Architecture

Encryption at Rest

Encryption: AES-256-GCM
Key Rotation: Automatic (annual) or on-demand

Encryption in Transit

Connection	Protocol	Certificate
Client → API	TLS 1.3	Public CA
Service → Service	mTLS	Internal PKI
Service → Database	TLS 1.2+	AWS RDS CA
Service → S3	HTTPS	AWS CA

Key Management

# Key hierarchy
AWS KMS Master Key (HSM-backed):
  - Project Data Key (per project):
      - Sample Encryption Key
      - Audio Encryption Key
      - DICOM Encryption Key
  - Audit Log Key
  - Backup Encryption Key

Access Control

Role-Based Access Control (RBAC)

Permission Matrix

Action	Owner	Admin	Member	Reviewer	Viewer
View samples	✅	✅	✅	✅*	✅
Create samples	✅	✅	✅	❌	❌
Delete samples	✅	✅	❌	❌	❌
Run evaluations	✅	✅	✅	❌	❌
Submit reviews	✅	✅	✅	✅	❌
Manage team	✅	✅	❌	❌	❌
Access audit logs	✅	✅	❌	❌	❌
Delete project	✅	❌	❌	❌	❌

*Reviewers can only view samples assigned to them

Minimum Necessary Access

Akhara enforces minimum necessary access principles:

# Reviewer sees only assigned samples
GET /v1/samples?assigned_to=me

# Response contains only:
{
  "id": "smp_abc123",
  "input": {...},        # Clinical content for review
  "output": {...},       # AI decision to evaluate
  # NO access to: other samples, raw audio URLs, full metadata
}

Audit Logging

All PHI access is logged:

{
  "event_id": "evt_abc123",
  "timestamp": "2025-01-15T10:30:00Z",
  "event_type": "phi.access",
  
  "actor": {
    "user_id": "user_xyz789",
    "role": "reviewer",
    "ip_address": "192.0.2.1"
  },
  
  "resource": {
    "type": "sample",
    "id": "smp_def456",
    "project": "proj_ghi789"
  },
  
  "action": "read",
  
  "phi_elements_accessed": [
    "transcript",
    "ai_decision"
  ],
  
  "context": {
    "task_id": "task_jkl012",
    "purpose": "clinical_review"
  }
}

See Audit & Provenance Pipeline for complete audit documentation.

Compliance Controls

HIPAA Technical Safeguards

Safeguard	Implementation
Access Control	RBAC, MFA, session management
Audit Controls	Comprehensive logging, tamper-proof storage
Integrity	Checksums, digital signatures
Transmission Security	TLS 1.3, mTLS for internal
Encryption	AES-256 at rest, TLS in transit

Data Residency

Region	Location	Designed for
US	AWS us-east-1	HIPAA (in progress)
US-West	AWS us-west-2	HIPAA (in progress)
EU	AWS eu-west-1	HIPAA + GDPR (in progress)
Custom	Your VPC	Enterprise

Data never leaves the configured region. Cross-region replication is disabled by default and requires explicit configuration with compliance review.

Configuration Reference

Project PHI Settings

client.projects.update(
    project="patient-triage",
    
    phi_config={
        "mode": "pseudonymize",
        "detection_threshold": 0.8,
        "custom_patterns": [...],
        "rules": {...},
        "log_all_access": True,
        "log_phi_locations": True,
        "phi_retention_days": 365,
        "auto_delete_on_expiry": True
    },
    
    encryption_config={
        "key_id": "alias/project-key",
        "algorithm": "AES-256-GCM"
    },
    
    access_config={
        "require_mfa": True,
        "session_timeout_minutes": 30,
        "ip_allowlist": ["192.0.2.0/24"]
    }
)

Best Practices

Minimize PHI Collection

Only collect PHI that’s necessary for evaluation:

# Consider de-identified upload
client.log(
    transcript=[...],  # De-identified before upload
    phi_config={"mode": "none"}  # Already clean
)

Use Test Data for Development

Never use production PHI in development:

# Development: use a test workspace with synthetic data
client = Akhara(
    api_key="gr_test_xxx"
)

Regular Access Reviews

Periodically review who has access to PHI:

# Get access report
report = client.compliance.access_report(
    project="patient-triage",
    period_days=90
)

Overview

Getting Started

Core Concepts

Onboarding Guides

Evaluation Framework

Tutorials

Integrations

PHI/PII Handling Model

Overview

Data Classification

PHI Categories

PII Categories

PHI Detection Pipeline

Detection Methods

De-identification Options

De-identification Modes

Configuration

De-identification Example

Encryption Architecture

Encryption at Rest

Encryption in Transit

Key Management

Access Control

Role-Based Access Control (RBAC)

Permission Matrix

Minimum Necessary Access

Audit Logging

Compliance Controls

HIPAA Technical Safeguards

Data Residency

Configuration Reference

Project PHI Settings

Best Practices

Next Steps

Audit Pipeline

System Overview

​Overview

​Data Classification

​PHI Categories

​PII Categories

​PHI Detection Pipeline

​Detection Methods

​De-identification Options

​De-identification Modes

​Configuration

​De-identification Example

​Encryption Architecture

​Encryption at Rest

​Encryption in Transit

​Key Management

​Access Control

​Role-Based Access Control (RBAC)

​Permission Matrix

​Minimum Necessary Access

​Audit Logging

​Compliance Controls

​HIPAA Technical Safeguards

​Data Residency

​Configuration Reference

​Project PHI Settings

​Best Practices

​Next Steps

Audit Pipeline

System Overview

Overview

Data Classification

PHI Categories

PII Categories

PHI Detection Pipeline

Detection Methods

De-identification Options

De-identification Modes

Configuration

De-identification Example

Encryption Architecture

Encryption at Rest

Encryption in Transit

Key Management

Access Control

Role-Based Access Control (RBAC)

Permission Matrix

Minimum Necessary Access

Audit Logging

Compliance Controls

HIPAA Technical Safeguards

Data Residency

Configuration Reference

Project PHI Settings

Best Practices

Next Steps