> It’s personally identifiable information (short: “PII”), but it’s not medical data.
Huh, is that the case in Italy? In the US your name and date of birth are very much PHI
Huh, is that the case in Italy? In the US your name and date of birth are very much PHI
Your name and date of birth when held by a HIPAA covered entity (where the mere fact of them being held by such an entity is a nexus to healthcare information from which it may be possible to deduce more specific healthcare information and associate it with the individual with only public data) is PHI. That’s true of PII generally.
Just to be clear here. This sentence is referencing the "codice fiscale" and that it is not [necessarily] medical data.
The "codice fiscale" is a code consisting of letters and numbers. It can e.g. contain the first letter of your name. An example is provided in one of the article's pictures.
I'm not a lawyer but "codice fiscale" is not PHI. The Italian Data Protection Authority puts codice fiscale under PII[0] and it's not mentioned in the PHI section[1,2,3,4].
[0] https://www.garanteprivacy.it/home/diritti/cosa-intendiamo-p...
[1] https://www.garanteprivacy.it/temi/dati-sanitari
[2] https://www.garanteprivacy.it/faq/fascicolo-sanitario
[3] https://www.garanteprivacy.it/faq/referti-online
[4] https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb...
[edit: formatting]
Anyhow, you should check also if a "tessera sanitaria" is considered a PHI since it includes the "codice fiscale" (and if I recall correctly, it is used often in "fascicoli sanitari" to identify an individual).
But well, I'm not a lawyer either.
Surely if you are only handling Names and DOB you don't have to be HIPAA compliant?
I mean, if you have to be HIPAA compliant (your application is medical-adjacent and/or is handling also other bits of data besides Name and DOB), then by correlating the DOB (or name) with the rest of the data, health information could be leaked, and thus you want to protect Name+DOB with the HIPAA standards (even just the fact that a certain name uses a certain app/is inside a certain system might be sensitive).
But otherwise... almost every system under the sun is ingesting name+DOB.
(there's a case to be made that the system described in the post is a medical app... but again: different jurisdiction)