PHI-aware data segregation

Description

The pattern that keeps regulated data classes (PHI under HIPAA, sensitive personal data under GDPR Article 9, financial data under GLBA) routed only through systems that are contractually and architecturally permitted to hold them. Boundaries are enforced explicitly at the data layer rather than relying on conventions that drift as the stack composes. Generalizes beyond healthcare to any regulated-class data with a BAA-equivalent contractual perimeter.

Common failure modes

• 01Boundary enforced by access control on the source system only, so any downstream system that pulls a record copies the regulated data past the boundary without acknowledgement
• 02Vendor BAA coverage assumed because the vendor has been contractually engaged in some other capacity, without verifying that the specific data flow is covered
• 03Boundary documented in architecture diagrams but not encoded in the data layer, so engineering changes silently breach it and the next compliance audit catches it
• 04Test environments stocked with production-derived data that crosses the boundary because de-identification was treated as sufficient when re-identification risk wasn't actually low

Tools for this pattern

The capability a stack needs to run this pattern, and the vendors that provide it, on Martech Stack Builder.

• NeedsPrivacy Vault / Tokenization
• RelatedData Access Control

Recipes composing this pattern

No published recipes compose this pattern yet.