The 21st century has seen a significant boom in the creation of electronic data, which has led to the digitalization of personal information. Although digitalization has provided significant benefits to companies and individuals alike, such unprecedented growth is not free from problems. The biggest one is issues of cyber security and how to protect your sensitive data. 

As the cyber world expands, so does the rate of cybercrimes. Hackers use new methods to penetrate security systems and use people’s information for various crimes. It is, therefore, Highly advisable for entities to protect their sensitive information, especially when it comes to Personally Identifiable Information and Personal Health Information. 

Two of the most common types of data used to commit largescale cybercrimes. But what data protection measures should one take? And what kind of information must be protected at all costs? Finally, what are the repercussions of not protecting your data? If you have all these questions in mind, then you’ve come to the right place. 

Our comprehensive guide on Personally Identifiable Information and Personal Health Information will answer all of these questions and more for you to understand information security and data protection clearly.

What is Personally Identifiable Information? 

Personally, Identifiable Information has a broad definition. It can include any type of information that can lead to identifying the person the data belongs to through various direct and indirect methods. 

This type of data comprises information that can directly identify the individual, such as their full name, personal address, telephone number, social security number, or any other code employed by institutes and companies for identification, email ID, and social media information. 

Or information that can lead to the identification of the individual through indirect methods. This can include the date of birth, gender, race, geographic location, various other demographics that cybercriminals can identify an individual. 

Any information, whether it is on paper, online, or any device, that can lead to the individual being identified either physically or online is known as Personally Identifiable Information. 

The importance of Personally Identifiable Information can be gauged by the fact that the European Union and various other countries have strict laws and regulations that enforce its protection in most nations; the breach of this type of data is a punishable act. 

An example of a regulation pertaining to violations of Personally Identifiable Information is the European Union’s General Data Protection Regulation that was passed in May 2018 and had a significant impact on the way companies handled the personal information of their employees. 

Under the GDPR, citizens of the European Union have the right to the protection of their data that is given to any company worldwide. Any breach of Information Security that can lead to the leaking of Personally Identifiable Information is heavily penalized unless reported and acted upon immediately (within 72 hours). 

Furthermore, if any company does not adhere to the strict guidelines of GDPR, it can be heavily fined depending on the measure of non-adherence; companies can be fined by up to 4% of their annual revenue. Although the GDPR allows companies to choose their data protection methods, they must be robust enough to offer adequate information security. 

Variations of such laws exist globally. However, the GDPR is one of the most comprehensive regulations to be put into full effect. 

What is Personal Health Information?

Personal Health Information (PHI), also known as Protected Health Information, is health-related information used to identify individuals. Personal health information can include data related to demographics, medical histories, laboratory and other tests, family medical history, health information, and other such data used to identify and treat individuals. 

Like personally identifiable information, Personal Health Information can be accessed and manipulated by criminals to commit various crimes such as identity theft. Digitally stored Personal health information is vulnerable to cyber-attacks if adequate measures of Information Security and data protection measures are not put in place. Cyber security is of utmost importance for companies, institutes, and organizations that deal with and store individuals’ personal health information. 

Although digitalization and having easy access to such data is vital for healthcare professionals to be able to provide quality and urgent care, it can also lead to serious security concerns if there is inadequate cyber security. 

For this reason, there are numerous laws and regulations in place globally to protect such information. Any individual or organization that causes a breach of such data mishandles personal health information of individuals or provides less than accepted information security measures is liable to be punished by law. 

One of the most comprehensive laws to deal with Personal Health Information in the US is The Health Insurance Portability and Accountability Act (HIPAA), which was enacted on August 21, 1996. HIPAA sets out a clear list of indications of what comes under Personal Health Information. 

These indicators can be used on their own or combined with other information to identify individuals. They include:

• Name
• Address
• Any dates specific to the person, such as their admission date, discharge date, birthdate, etc. 
• Fax numbers
• Phone numbers
• Numbers and codes that identify health plans
• Email ID
• Medical Record (MR) number
• License number
• Social security number
• Any account number
• Serial numbers that lead to the identification of devices used by an individual
• Information that can lead to the identification of their vehicle, such as their number plate
• IP address
• Any web addresses specific to the individual
• Information about characteristics that are unique to them
• Biometric data of the individual such as their voice ID, fingerprint, or biometric code
• Pictures of the individual or of personal traits that can lead to their identification

Personal health information is helpful for clinicians, researchers, and organizations for many reasons. Not only does accurate health information help clinicians provide timely and thorough care, but it can also help provide early diagnosis and predictions of the likely discourse the disease may take. 

Furthermore, personal health information can help provide information about general disease trends within the population and current health conditions and care. However, this information can also easily be manipulated and used for personal gains and criminal activity. 

Regulations such as HIPAA help prevent such unlawful activities and hold organizations accountable for how they handle sensitive information. 

Why Is It Important To Protect Personally Identifiable Information and Personal Health Information?

Personally Identifiable Information and Personal Health Information are both data that can lead to serious repercussions if in the wrong hands. This type of data is especially prone to cyber-attacks as it can be used to commit a multitude of crimes. 

One of the most prevalent crimes committed through theft of Personally Identifiable Information and Personal Health Information is Identity theft. 

According to a report by IBM published in 2020, 80% of businesses that were researched reported some breach in the personally identifiable information of their customers. 

As is evident from all the numbers, individuals’ concerns about cybersecurity relating to their personally identifiable information and personal health information are due to good reason. This type of information can lead to a variety of criminal activity including:

• Credit card fraud
• Bank fraud
• Email Ids being hacked and being used for malicious intent
• Social media accounts being hacked and used for malicious purposes
• Tax fraud
• Fraudulent applications for credit or loan

How Can You Protect Personally Identifiable Information and Personal Health Information?

Information security and data protection are of utmost importance in today’s digital world. Following are a few measures individuals can take to ensure their data is well protected:

• Use of Encryption At Rest and In-Transit when handling datasets with sensitive data
• Tokenization to overlay or replace the sensitive data with non-identifiable information
• Redaction of sensitive data so that only the appropriate users may access the data

Conclusion

Despite numerous steps being taken by international communities and global leaders, the genuine looming threat of cyber-attacks exists. 

Any entity found privy to cyberattacks is likely to be penalized heavily by the law and need to make sure that adequate protections have been implemented before an incident occurs.  Teradact’s TokenizerPlus (Tokenizer+) and RedactorPlus (Redactor+) provide intelligent and automated AI/ML based solutions to protect your company’s sensitive data.  Please contact us for more information.