phi-pii-detection

PHI/PII Leak Detection

Scan your codebase for Protected Health Information (PHI) and Personally Identifiable Information (PII) exposure, the #1 HIPAA violation vector.

When to Use

• Before any deployment to production
• After adding new logging, error handling, or API endpoints
• During HIPAA compliance reviews
• When onboarding new developers to verify secure coding practices

Sensitive Data Categories

Critical (block deploy if found)

• Social Security Numbers (SSN)
• Passwords, API keys, tokens
• Credit card / bank account numbers
• Full medical record numbers

High (fix within 7 days)

• Date of birth combined with patient name
• Diagnosis codes combined with patient identifiers
• Insurance member IDs with patient info
• Full addresses with health context

Medium (fix within 30 days)

• Email addresses in logs
• Phone numbers in error messages
• Partial identifiers without context

Search Patterns

Logging Statements

# JavaScript/TypeScript
console\.(log|warn|error|info|debug)\(.*\b(patient|ssn|dob|diagnosis|creditCard|bankAccount|socialSecurity|dateOfBirth|insuranceId|memberId)\b
logger\.(info|warn|error|debug)\(.*\b(patient|ssn|dob|diagnosis|creditCard|bankAccount)\b

# Python
logging\.(info|warning|error|debug|critical)\(.*\b(patient|ssn|dob|diagnosis|credit_card|bank_account)\b
print\(.*\b(patient|ssn|dob|diagnosis)\b

# Go
log\.(Print|Printf|Println|Fatal|Panic)\(.*\b(patient|ssn|dob|diagnosis)\b

# Java
(logger|LOG)\.(info|warn|error|debug)\(.*\b(patient|ssn|dob|diagnosis)\b
System\.out\.print.*\b(patient|ssn|dob|diagnosis)\b

Error Responses

# Sensitive data in thrown errors
throw new.*Error\(.*\b(patient|ssn|dob|diagnosis|insurance)\b
raise.*Exception\(.*\b(patient|ssn|dob|diagnosis)\b

# Sensitive data in API responses
res\.(json|send|status)\(.*\b(patientName|SSN|dateOfBirth)\b
return.*(Response|JsonResponse)\(.*\b(patient|ssn|dob)\b

Hardcoded Test Data (non-test files)

# SSN patterns outside test files
\b\d{3}-\d{2}-\d{4}\b

# Real-looking medical record numbers
\bMRN[:\s]*\d{6,10}\b