How to Map and Inventory Protected Health Information Across Your Organization

Why PHI Mapping Is the Foundation of Protected Health Information Compliance

You cannot protect what you cannot find. That statement sounds obvious, yet it describes the single most common failure I see during HIPAA assessments: organizations that have invested in security tools, written policies, and trained their workforce, but have never produced a credible, current inventory of where their protected health information actually lives.

A PHI map is not a one-time documentation exercise. It is the operational backbone of your entire healthcare compliance program. Without it, your risk assessments are guesswork, your business associate agreements may be missing counterparties, and your incident response team will waste critical hours during a breach trying to determine which systems were affected. This guide walks you through how to build that inventory systematically and keep it current.

Step 1: Define the Scope Before You Start Searching

Before your team begins cataloging systems, you need a clear working definition of what you are looking for. Under HIPAA, protected health information is individually identifiable health information transmitted or maintained in any form or medium by a covered entity or business associate. That definition is broader than most compliance managers initially assume.

PHI is not limited to electronic health records. It includes:

• Patient names combined with diagnosis codes, appointment dates, or treatment information
• Billing records that link an individual to a specific service or provider
• Lab results, radiology images, and pathology reports
• Email threads that discuss a patient's condition
• Voicemails, fax transmissions, and paper records
• Photographs or videos used in clinical documentation
• Scheduling systems that associate names with appointment types

For a comprehensive reference on the full scope of what qualifies, review our post on what counts as protected health information before you begin scoping your inventory project.

Step 2: Build Your Data Discovery Team

PHI mapping is not solely an IT function. Successful inventories require participation from clinical operations, revenue cycle, human resources, facilities, and legal. Each department owns data flows that IT cannot fully see from a network perspective alone.

Assign a data owner to each business unit. That individual is responsible for identifying where PHI enters, is used, is stored, and exits their area of responsibility. This distributed ownership model produces more accurate results than a centralized IT-driven scan because it captures informal workflows, shadow systems, and analog processes that automated tools miss.

If your organization lacks internal compliance leadership with the bandwidth to coordinate this effort, an outside Regulatory vCISO can serve as the program lead, providing the structure and cross-functional authority needed to keep the project moving.

Step 3: Catalog Every System That Creates, Receives, Stores, or Transmits PHI

Work through your environment systematically, starting with the systems most likely to hold PHI in volume and expanding outward. A practical starting checklist includes:

1. Clinical systems: EHR and EMR platforms, PACS systems, laboratory information systems, pharmacy management software
2. Revenue cycle systems: Practice management platforms, billing software, claims clearinghouses, patient payment portals
3. Communication systems: Email servers, secure messaging platforms, fax servers, voicemail systems
4. Collaboration and storage: SharePoint, OneDrive, Google Drive, shared network drives, cloud storage accounts
5. Endpoint devices: Workstations, laptops, tablets, mobile phones used for clinical or administrative work
6. Backup and archive systems: Tape backups, offsite storage, disaster recovery environments
7. Third-party integrations: Interfaces with health information exchanges, payers, or public health agencies
8. Physical media: Paper records, portable hard drives, CDs containing imaging data

Document the system name, owner, data classification, access controls in place, and whether a business associate agreement is required for the vendor operating or supporting that system. Protecting data across these varied environments requires strong endpoint and infrastructure controls, and our overview of endpoint security fundamentals is a useful reference for the technical layer of this work.

Step 4: Map PHI Data Flows

A system inventory tells you where PHI sits. A data flow map tells you where it moves. These are two distinct deliverables, and both are required for a defensible HIPAA risk assessment.

For each system in your inventory, document:

• What PHI enters the system and from what source
• What PHI leaves the system and to what destination
• Whether that transmission is encrypted in transit
• Whether the receiving party is internal or a third-party business associate
• The frequency and volume of data movement

Pay particular attention to interfaces between systems. Integration points, HL7 feeds, APIs, and automated file transfers are where unauthorized PHI movement most often occurs without the knowledge of compliance teams. Data loss prevention tools can help monitor these flows once they are mapped. For context on how DLP supports PHI protection, see our post on understanding data loss prevention.

Step 5: Assess Risk at Each Location and Touchpoint

With your inventory and data flow map complete, you have the inputs you need to conduct a meaningful HIPAA Security Rule risk analysis. The OCR expects organizations to evaluate the probability and impact of potential threats to the confidentiality, integrity, and availability of PHI at each location and along each data flow path.

Prioritize your risk assessment around the locations where PHI is most concentrated, least controlled, or most frequently transmitted to external parties. Cloud and mobile environments deserve special attention. As remote work has become standard in healthcare administration, PHI now regularly traverses home networks, personal devices, and consumer-grade cloud platforms. Our guidance on protecting PHI across cloud, mobile, and remote work environments addresses the specific controls these scenarios require.

Organizations that want expert guidance through the full risk analysis process will find our Federal and SLED Risk Assessment services directly applicable, as the methodology maps closely to what HIPAA's Security Rule demands.

Step 6: Reconcile Your Inventory Against Your Business Associate Agreements

Every vendor, contractor, or subcontractor that creates, receives, maintains, or transmits PHI on your behalf must have an executed business associate agreement in place. Your PHI inventory will almost certainly surface gaps.

Pull your complete list of business associate agreements and compare it against the third-party systems and service providers identified in your inventory. Common gaps include cloud storage providers, IT managed service firms, billing services, scheduling software vendors, and transcription services. For each gap, either execute the required agreement or discontinue the data sharing arrangement.

Step 7: Document Everything and Assign Remediation Ownership

Your completed PHI inventory should be a living document stored in a controlled location with version history. It should include the assessment date, the team members who contributed, and a clear record of any gaps identified along with the assigned owner and remediation deadline for each.

If your organization also handles federal contract data or operates across multiple regulated frameworks, structuring this documentation in a way that satisfies both HIPAA and other applicable requirements is worth the upfront investment. Our Compliance Program Development service is specifically designed to help organizations build that kind of durable, multi-framework documentation structure.

For teams that want a ready-to-use documentation starting point, our HIPAA Compliance Documentation Toolkit provides structured templates for policies, risk assessments, and inventory frameworks that align with OCR expectations.

Maintaining Your PHI Inventory Over Time

A PHI map completed today is accurate today. Without a maintenance process, it degrades rapidly as new systems are deployed, workflows change, and vendors are added or removed. Build your inventory review into your annual HIPAA risk assessment cycle, and require that any new system capable of handling PHI be reviewed by compliance before deployment.

Assign a trigger-based review process as well. Any merger, acquisition, significant system change, or new third-party integration should automatically initiate an inventory update. The cost of keeping the map current is a fraction of the cost of discovering during a breach investigation that PHI existed in systems no one knew about.

Start Your PHI Mapping Exercise with a Clear Plan

A thorough PHI inventory is not a project you can delegate entirely to an automated scanner or complete over a single afternoon. It requires cross-functional coordination, structured methodology, and executive support to succeed. The organizations that do this work well are the ones that experience far fewer surprises during OCR audits and breach investigations.

If your organization needs guidance building or validating your PHI mapping program, Cleared Systems can help. Request a quote to speak with our compliance team about how we approach PHI inventory projects for healthcare organizations, covered entities, and business associates operating in complex environments.