--- title: "Data Security Guidance: Job Aid for Analysis of Security of PHI" description: If your Organization has experienced an Incident, please use the chart below to determine if there is unsecured PHI involved. --- [Skip to content](https://knowledge.compliancygroup.com/home/support/solutions/articles/48001193188-job-aid-for-analysis-of-security-of-phi#main-content) English - United States Show submenu for translations [Submit a Ticket](https://knowledge.compliancygroup.com/home/kb-tickets/new?hsLang=en-us) [Go To Customer Portal](https://help.compliancygroup.com/home?hsLang=en-us) ![Compliancy Group](https://knowledge.compliancygroup.com/hs-fs/hubfs/Compliancy%20Group%20Logo%20Full%20RBG-sized.png?width=300&height=54&name=Compliancy%20Group%20Logo%20Full%20RBG-sized.png) Open main navigation Close main navigation - English - United States Show submenu for translations - [Submit a Ticket](https://knowledge.compliancygroup.com/home/kb-tickets/new) - [Go To Customer Portal](https://help.compliancygroup.com/home) How can we help you? - There are no suggestions because the search field is empty. 1. [Help Center](https://knowledge.compliancygroup.com/home?hsLang=en-us) 2. [Healthcare Compliance](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us) 3. [Data Security](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#data-security) # Data Security Guidance: Job Aid for Analysis of Security of PHI If your Organization has experienced an Incident, please use the chart below to determine if there is unsecured PHI involved.  If there is unsecured PHI, continue on and complete the [Breach Determination Assessment Form](https://knowledge.compliancygroup.com/home/home/legacy-completing-the-breach-determination-assessment-form?hsLang=en-us) to determine if the Incident is a Breach.   HIPAA Privacy and Security Rule Policy Determination of a Breach of Unsecured Protected Health Information     | Was the PHI unsecured or was it rendered unusable, unreadable or indecipherable to unauthorized individuals under standards established in current HHS guidance? **Determine the format of the information and apply the appropriate standards in the corresponding column(s).** | | | | | --- | --- | --- | --- | | **Is it a paper, film or other hard copy media?** | **Is it electronic media?** | **Is it data at rest?** | **Is it data in motion?** | | Privacy Officer should determine if it was shredded or destroyed in a manner that the PHI could not be read or otherwise reconstructed. Note: Redaction is not an acceptable means of destruction. | Security Officer should determine if it was cleared, purged or destroyed in a manner assuring the PHI cannot be retrieved from the media  - meeting the [NIST     Guidelines for Media Sanitation](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) for the type of media involved. | Security Officer should determine if it was validly encrypted in accordance with [NIST Special Publication 800-111](http://csrc.nist.gov/publications/nistpubs/800-111/SP800-111.pdf) *and the encryption key was not compromised*. | Security Officer should determine if it was validly encrypted using a process that complies with the appropriate NIST standard ([800-52](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r1.pdf) Transport Layer Security standard or   [800-77](http://csrc.nist.gov/publications/nistpubs/800-77/sp800-77.pdf) or [800-13](http://csrc.nist.gov/publications/nistpubs/800-13/sp800-13.pdf) VPN standards). | | Destroyed & not reconstructable: The PHI was secured.  This should be documented and no breach occurred. | Meets Sanitation guidelines: The PHI was secured.  This should be documented and no breach occurred. | Validly encrypted – key uncompromised: The ePhi was secured.  This should be documented and there is no breach. | Validly encrypted or validated: The ePHI was secured.  This should be documented and there is no breach. | | No: it was unsecured PHI and the breach assessment must be completed. | No: It was unsecured PHI and the breach assessment must be completed. | No: It was unsecured PHI and the breach assessment must be completed. | No: It was unsecured PHI and the breach assessment must be completed. |  *This article was last updated on May 18, 2023.* - [Getting started](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#main-content) - [Onboarding](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#onboarding) - [Product Overviews](https://knowledge.compliancygroup.com/home/getting-started?hsLang=en-us#product-overviews) - [Workforce](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#main-content) - [Policies](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#policies) - [Settings Module](https://knowledge.compliancygroup.com/home/workforce?hsLang=en-us#settings-module) - [3rd Party Risk](https://knowledge.compliancygroup.com/home/3rd-party-risk?hsLang=en-us) - [Incident Management](https://knowledge.compliancygroup.com/home/incident-management?hsLang=en-us) - [Risks & Assessments](https://knowledge.compliancygroup.com/home/risks-assessments?hsLang=en-us) - [Healthcare Compliance](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#main-content) - [Privacy](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#privacy) - [Data Security](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#data-security) - [OSHA Workplace Safety](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#osha-workplace-safety) - [Clinical & Quality](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#clinical-quality) - [State Requirements](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#state-requirements) - [Fraud, Waste & Abuse](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#fraud-waste-abuse) - [Compliance Operations](https://knowledge.compliancygroup.com/home/healthcare-compliance?hsLang=en-us#compliance-operations) - [Legacy Guard Features](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#main-content) - [Admin - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#admin-legacy) - [Assets - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#assets-legacy) - [Documents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#documents-legacy) - [Incidents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#incidents-legacy) - [My Documents - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#my-documents-legacy) - [My Tasks - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#my-tasks-legacy) - [People - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#people-legacy) - [Programs - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#programs-legacy) - [Reports - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#reports-legacy) - [The Dashboard - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#the-dashboard-legacy) - [Training - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#training-legacy) - [Vendors - Legacy](https://knowledge.compliancygroup.com/home/legacy-guard-features?hsLang=en-us#vendors-legacy) - [Account & Billing](https://knowledge.compliancygroup.com/home/account-billing?hsLang=en-us) - [The Guard Support](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#main-content) - [P&P Drafts](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#pp-drafts) - [Settings](https://knowledge.compliancygroup.com/home/the-guard-support?hsLang=en-us#settings) [![compliancy-group-logo-white](https://knowledge.compliancygroup.com/hs-fs/hubfs/compliancy-group-logo-white.png?width=200&height=37&name=compliancy-group-logo-white.png "compliancy-group-logo-white")](http://compliancy-group.com) Contact Us - [support@compliancygroup.com](mailto:support@compliancygroup.com) Copyright © 2026, Compliancy Group LLC Cookie Settings