Healthcare
42 CFR Part 2 records, and where substance use details leak in medical files
42 CFR Part 2 guards substance use disorder treatment records more tightly than HIPAA. Here is what it covers, and where SUD details leak in medical files.
Blog
Redaction and de‑identification, explained.
Practical guides to redacting PII and PHI from real-world documents, and to the HIPAA, FERPA and FOIA rules behind them.
Legal
Court redaction rules by state: what each state lets a filing show
Most states limit what a court filing may show of Social Security numbers, account numbers and birth dates. Here is the rule in all 50 states and D.C.
Finance
SAR confidentiality, and where a SAR's existence leaks in bank records
A SAR, and anything that would reveal one exists, is confidential under the Bank Secrecy Act. Here is what that covers, and where bank records give it away.
Human Resources
Employee medical records under the ADA, FMLA and GINA, and where they leak
An employer's medical records on its staff fall under the ADA, FMLA and GINA, not HIPAA. Here is what each law requires, and where medical details leak.
Education
Student health records under FERPA or HIPAA, and where health details leak
Health records a school keeps on its students usually fall under FERPA, not HIPAA. Here is which law covers which record, and where health details leak.
Government
FOIA Exemption 5 and the deliberative process privilege, and where drafts leak
FOIA Exemption 5 shields privileged internal agency records, most often under the deliberative process privilege. Here is the test, and where drafts leak.
Legal
State court redaction rules, and where a federal-ready filing falls short
State courts don't follow FRCP 5.2, and their redaction rules vary. Here is what California, Texas, Florida and New York require, and where filings fall short.
Healthcare
HIPAA limited data sets, and where direct identifiers hide in real records
A HIPAA limited data set may keep dates and ZIP codes but must drop 16 direct identifiers. Here is the rule, and where those identifiers hide in real records.
Finance
GLBA nonpublic personal information, and where it hides in financial files
Under GLBA, nonpublic personal information covers applications, account history and even being a customer. Here is the rule, and where financial files leak.
Human Resources
Age questions on job applications, and where age still shows on resumes
Federal law doesn't ban asking an applicant's age, but several states do. Here is what an application may ask, and where resumes still give age away.
Finance
PCI DSS card number masking, and where full card numbers hide in documents
PCI DSS lets a displayed card number show at most the BIN and last four digits, and bans storing the CVV. Here is the rule, and where documents still leak.
Government
FOIA Exemptions 6 and 7(C), and where privacy leaks in released records
FOIA Exemptions 6 and 7(C) protect privacy in agency records under two different standards. Here is how each works, and where released records still leak.
Education
What FERPA counts as PII, and where it hides in student records
FERPA defines personally identifiable information in seven parts, and the name is only the first. Here is each one, and where they hide in student records.
Legal
What Rule 5.2 makes you redact from court filings, and where filings still leak
FRCP 5.2 limits what a court filing may show of SSNs, birth dates, minors' names and account numbers. Here is the rule, and where filings still leak.
Healthcare
The 18 HIPAA identifiers, and where they hide in real documents
HIPAA's Safe Harbor method lists 18 identifiers to remove before health data counts as de-identified. Here is each one, and where they slip past a text search.