PHI hides in test fixtures, sample files, log statements, error messages, database dumps, config files and code comments. If a record is individually identifiable health information, it counts as PHI whether it sits in production or in a repository. Scan repositories, remove the data, rotate anything exposed and ask counsel about reporting.
What counts
The definition of protected health information is individually identifiable health information transmitted or maintained in any form, with some exclusions such as employment records held as employer. Electronic PHI is the part held in electronic media. A name with a diagnosis in a JSON file is a record. A real patient ID in a debug log may be one too.
The usual hiding places
| Location | Example | Fix |
|---|---|---|
| Test fixtures | Real exported rows used as sample data | Replace with synthetic data |
| Logs and error traces | Request bodies logged on failure | Redact fields before logging |
| Database dumps | A dump committed for debugging | Delete and purge history |
| Config and seed files | Admin test accounts with real emails | Use fake accounts |
| Comments and tickets | Pasted patient examples | Replace with placeholders |
| Notebooks and spreadsheets | Analyst exports | Store in controlled systems |
| Screenshots in docs | Production UI captures | Mask before saving |
How to scan
- Start with a pattern scan over the working tree and full git history for identifiers such as names with record numbers, dates of birth and email formats.
- Add a rule for the data formats your systems use, such as fixed width message files.
- Run static analysis to find code that logs request objects or sends fields to third party SDKs.
- Check CI artifacts and container images, which also copy files.
- Review who has read access to the repo, including forks.
Try it yourself
Click through it at your own pace, or open it full screen. Open a finding and see how the scan points to the line where sensitive data reaches a log or output.
If you find some
Do not just delete the file. Removing a file leaves it in history. Rewrite history or purge, rotate any credentials that appeared beside it, and record what happened. Whether it is a reportable breach depends on facts, so involve counsel and your privacy officer early.
Stop it coming back
Use synthetic data generators, add a pre commit scan, and ban production exports from developer machines.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is a private repo safe enough for PHI?
Treat it as a system holding ePHI if it does. Apply access control and audit, or keep PHI out of it.
Is masked data still PHI?
It depends on whether it is still individually identifiable. De identification has specific standards, so ask counsel.
Sources
Last reviewed: 19 October 2026.
