Patient data in brain: PHI scope
Ticketclosed
Quarrington Care Network: documents · Patient data in brain: PHI scope
Marisol flagged that patient names and diagnoses from intake forms were appearing in brain search results, exceeding business associate agreement scope. Olivia identified the connector issue, excluded the field, and reindexed the data.
What happened
What this says
Current to 11 Oct 26Marisol flagged that patient names and diagnoses from intake forms were appearing in brain search results, exceeding business associate agreement scope. Olivia identified the connector issue, excluded the field, and reindexed the data.
Problem: Patient names and diagnoses from the intake form free-text field were being indexed and appearing in search results, exceeding the scope of the business associate agreement and violating data minimisation requirements.
Handling: Olivia and Ewan identified the root cause: the connector was ingesting the full free-text field to support search, capturing PHI that should have been excluded. Olivia updated the configuration to exclude the field entirely, took effect immediately, and scheduled reindexing for the nightly refresh to remove affected records. She documented the control in the connector settings and agreement addendum.
Watch: Serious compliance issue handled well. Fast response and transparent remediation. Demonstrates strong data governance for regulated customers.
Details
Updated 9 Oct 26Trail
- internal_note · Olivia Grant 8 Jul 2026 10:18Marisol reported patient names and diagnoses in intake form search results. Checking if full free-text field is being indexed. Ewan to review ingestion config.
created · Marisol Vega 8 Jul 2026 15:10Good afternoon, I'm writing to flag a data-quality issue requiring urgent attention. In the brain, I'm seeing patient names and diagnosis information appearing in search results from the intake form's free-text field. Is any PHI in scope for this integration? Our understanding was that only structured fields (referral source, admission date, and case manager notes) would be indexed. Before we proceed, I need to confirm: 1. Which fields from the intake form are being indexed? 2. Are we capturing the full free-text field, including patient identifiers and diagnoses? 3. How is this aligned with our business associate agreement? Please confirm the minimum necessary data is in scope and document the control. Best regards, Marisol Vega- public_reply · Olivia Grant 8 Jul 2026 15:30Hi Marisol, Thanks for flagging this. You're absolutely right to check. Let me walk you through what we're capturing and confirm it matches your business associate agreement. The issue is in our intake form connector configuration. We included the full free-text field to support search, but that captures patient names and diagnoses which shouldn't be there under your BAA. We've updated your connector to exclude that field entirely. The change took effect this morning, and we're reindexing your data now. Any records with that field indexed will be removed in tonight's refresh. To document the control: we've locked this field in your configuration and added it to the restricted list in your agreement addendum. You can see the change in your connector settings under Integrations. Can you confirm that's aligned with your requirements? Cheers, Olivia
- status_change · 14 Jul 2026 23:59