Topic hub
PHI Workflows
A hub for how PHI appears in messaging, files, forms, spreadsheets, AI tools, and operational coordination workflows across healthcare teams.
Short answer
PHI workflow decisions are rarely about one rule in the abstract. They are about where patient-linked information shows up in day-to-day coordination and whether the tool, contract, and operating habits actually support that use.
PHI workflows are where healthcare teams usually get into trouble. The rule may be clear at a high level, but the real question is whether a patient-linked message, file, note, or task can safely pass through the tool your staff already uses every day.
PHI workflow pages
- PHI in Email
- PHI in Text Messaging
- PHI in Voicemail
- PHI in Fax
- PHI in Spreadsheets
- PHI in AI Tools
- PHI in Scheduling and Intake Forms
- PHI in Task Comments and Notifications
- How to Handle Shared Inboxes That Contain PHI
- PHI in Referral Coordination: Risks and Safer Patterns
- PHI in Imaging Workflows: What Small Clinics Get Wrong
- PHI in Paper Records: Fax, Mail, and Physical File Risks
- Separating Administrative Tasks from Patient-Chart Work
- PHI in Billing and Coding Workflows
- PHI in Cloud Storage: Box, Dropbox, and OneDrive Risks
How to use this hub
Start with the workflow your staff already depends on. If the workflow involves external messaging, read the channel page first. If the workflow involves internal coordination, read the page on spreadsheets, task comments, or AI tools. Then move into the matching vendor guide before you let the workflow harden into policy.
What to do after this hub
Use PHI Tools and Vendors if the next question is whether Slack, Google Drive, Teams, or another platform can support the workflow.
Use PHIGuard product if the workflow needs a safer home for recurring PHI-bearing coordination, ownership, and auditability.
Use the vendor BAA tracker if you need to document which vendors and contract terms support each workflow.
Admin Tasks vs Patient-Chart Work
Mixing admin tasks and clinical work in generic tools creates PHI exposure. Learn how small clinics can separate these cleanly and what HIPAA requires.
How to Handle Shared Inboxes That Contain PHI
HIPAA risks of shared email inboxes in clinics, including the unique user ID requirement, access control, and safer operating models.
PHI in Billing and Coding Workflows
How PHI flows in medical billing and coding workflows. Which vendors need BAAs, minimum necessary access for billing staff, and common PHI exposure patterns.
PHI in Cloud Storage
When does cloud storage create HIPAA risk? Box, Dropbox, and OneDrive BAA availability, PHI risk patterns, and compliant cloud storage for small clinics.
PHI in Imaging Workflows
DICOM files embed patient identifiers. Learn where imaging PHI risks concentrate for small clinics and what HIPAA requires for in-house imaging.
PHI in Paper Records
Paper PHI in small clinics: fax risks, physical chart controls, mail handling, and disposal requirements under HIPAA's Privacy and Security Rules.
PHI in Referral Coordination
HIPAA risks in referral coordination: misdirected faxes, minimum necessary PHI, and safer referral workflow patterns for small clinics.
PHI in CRM Records
PHI in CRM records: HubSpot and Salesforce BAA scope, lead forms that capture conditions, note fields, and marketing automations.
PHI on Mobile Devices and BYOD
PHI on mobile devices and BYOD: §164.310(d) device controls, MDM, lost-device protocol, SMS and photo risks, and encryption expectations.
PHI in Shared Calendars
PHI in shared calendars: why event titles, attendee lists, and third-party integrations expose patient information and how to lock it down.
PHI in Slack DMs
PHI in Slack DMs: Enterprise Grid BAA requirement, how DMs bypass retention, and why channel leakage keeps happening in clinics.
PHI in Zoom Meetings
PHI in Zoom meetings: BAA requirements, recording storage, chat and transcript risk, and the settings clinics should lock down.
HIPAA Compliant Email Providers: What to Look For
HIPAA compliant email requires a BAA, encryption, and audit logging. Learn what to look for and how major email providers stack up for clinics.
HIPAA Compliant Online Fax Services: Evaluation Guide
HIPAA compliant online fax requires a BAA, TLS encryption, and audit logging. Learn how to evaluate fax-to-email and cloud fax services for clinic use.
HIPAA Compliant Telehealth Platforms: Evaluation Guide
HIPAA compliant telehealth platforms need a BAA, encrypted video, access controls, and audit logs. Learn how to evaluate vendors for clinical use.
PHI in AI Tools
PHI in AI tools explained for healthcare teams, including prompt risks, vendor review, and safer workflow design.
PHI in Email
PHI in email explained for healthcare teams, including common failure modes, safeguards, and when to move the workflow elsewhere.
PHI in Fax
PHI in fax explained for healthcare teams, including modern digital fax workflow risks and safeguards.
PHI in Scheduling and Intake Forms
PHI in scheduling and intake forms explained for healthcare teams, including common form data risks and vendor review questions.
PHI in Task Comments and Notifications
PHI in task comments and notifications explained for healthcare teams with common leak points and safer workflow patterns.
PHI in Spreadsheets
PHI in spreadsheets explained for healthcare teams, including why trackers become PHI systems and when to move the workflow.
PHI in Text Messaging
PHI in text messaging explained for healthcare teams with common risks, safeguards, and workflow alternatives.
PHI in Voicemail
PHI in voicemail explained for healthcare teams, including what belongs in a message and common disclosure mistakes.
Sources