I’ve always been impressed by the professionalism and dedication of our employees.
All of this turns on what is considered PII. Apparently there isn’t a standard, so its what the organization says it is. However, in none of the US government systems I’ve found is a name alone considered PII, its the reference of a name and another piece of information that makes it PII. Even HIPAA doesn’t reference PII, it refer to PHI (Personal Health Information) and requires the references to have health data attached.
Per the US government (primarily defined by the National Institute of Standards and Technology (NIST) and the Office of Management and Budget), PII is any information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other linked or linkable data. [1, 2, 3, 4]
PII is generally divided into two main categories:
1. Direct Identifiers
Information that is unique to a person and can identify them on its own. [1, 2]
- Full name
- Social Security Number (SSN)
- Passport number
- Driver’s license number
- Biometric records (fingerprints, retinal scans)
- Government-issued ID numbers [1, 2, 3]
2. Indirect (Linkable) Identifiers
Information that cannot identify a person on its own, but can be used to trace an identity when combined with other data. [1, 2]
- Date and place of birth
- Mother’s maiden name
- Medical or health information
- Educational and employment records
- Financial data (bank routing/account numbers)
- Digital footprints (IP addresses, device IDs) [1, 2, 3, 4, 5]
Why this matters
Because there is no single, overarching federal law for PII in the US, different agencies and states enforce their own regulations. Information like medical records or financial data may be additionally protected under specific laws like HIPAA. [1, 2, 3]
6 Likes
All true. But HIPAA does define PII as Patient Identifiable Information. That existed well before the computer security definition of Personally Identifiable Information. I could locate (with some effort) an EMT textbook where that was defined back to 1999.
We had a giant conversation about if this was related to their fear of a potential HIPAA violation, which they would not be liable for, but I could imagine the gov being ultra paranoid about it. The DOJ is an organization of lawyers, after all. This paper was difficult for me to write because I had to put a lot of thought into how to walk that line appropriatley. It was tricky. I can see why more people dont write in.
The government fired warning shots at me. I have no idea why.
But I fired into the air, back at them. There was a little skirmish and they stood down. It was odd. I can’t explain it.
All I can come up with is that I spoke about some things that ‘polite company’ doesn’t talk about. It might have made some people uncomfortable. It made ME uncomfortable.
1 Like