![](media/image13.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**PHI Identification Worksheet for Phase Mirror Customers**

**Purpose:** This worksheet helps you determine whether Protected Health
Information (PHI) will be processed through Phase Mirror services, and
whether a Business Associate Agreement (BAA) is required.

**Instructions:** Complete all sections of this worksheet. If you answer
\"Yes\" or \"Unsure\" to any question in Section 2 or 3, a BAA is
required.

**Section 1: Organization Information**

  Field                   Your Response
  ----------------------- ---------------
  **Organization Name**   
  **Contact Person**      
  **Email**               
  **Phone**               
  **Date Completed**      

**Are you a:**

-   ☐ Healthcare provider (hospital, clinic, physician practice, etc.)

-   ☐ Health plan or health insurance company

-   ☐ Healthcare clearinghouse

-   ☐ Business associate of any of the above

-   ☐ None of the above

**Section 2: PHI Presence Assessment**

**Question 1: What type of AI systems will Phase Mirror analyze?**

Check all that apply:

-   ☐ Clinical decision support systems

-   ☐ Diagnostic AI (radiology, pathology, etc.)

-   ☐ Patient triage or scheduling systems

-   ☐ Electronic Health Record (EHR) integrations

-   ☐ Claims processing or billing systems

-   ☐ Population health management tools

-   ☐ Patient engagement or communication platforms

-   ☐ Medical coding or documentation assistance

-   ☐ Drug discovery or research systems (using patient data)

-   ☐ Predictive analytics for patient outcomes

-   ☐ Remote patient monitoring systems

-   ☐ Other healthcare-related AI:
    > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

-   ☐ Non-healthcare AI systems

**If you checked any healthcare-related system → Proceed to Question 2**

**Question 2: Will patient-identifiable information be present in any of
these areas?**

  Area                                                                         Yes   No   Unsure
  ---------------------------------------------------------------------------- ----- ---- --------
  **Configuration files** uploaded to Phase Mirror                             ☐     ☐    ☐
  **Code repositories** analyzed by Phase Mirror                               ☐     ☐    ☐
  **Log files or error messages** from your AI systems                         ☐     ☐    ☐
  **Sample data or test datasets** used in Phase Mirror                        ☐     ☐    ☐
  **Documentation or specs** shared with Phase Mirror                          ☐     ☐    ☐
  **Dissonance reports** generated by Phase Mirror                             ☐     ☐    ☐
  **Governance artifacts** (policies, SLAs) created with Phase Mirror          ☐     ☐    ☐
  **Training materials or examples** discussed with Phase Mirror consultants   ☐     ☐    ☐
  **API responses or data schemas** from your systems                          ☐     ☐    ☐
  **File names, variable names, or comments** in code                          ☐     ☐    ☐

**If you answered \"Yes\" or \"Unsure\" to ANY item → A BAA is
required**

**Question 3: PHI Elements Check**

Will ANY of the following identifiers be present in data processed by
Phase Mirror?

**Direct Identifiers:**

-   ☐ Patient names (first, last, maiden)

-   ☐ Geographic subdivisions smaller than state (street address, city,
    > county, ZIP code)

-   ☐ Dates directly related to an individual (birth date, admission
    > date, discharge date, death date)

-   ☐ Telephone numbers

-   ☐ Fax numbers

-   ☐ Email addresses

-   ☐ Social Security numbers

-   ☐ Medical record numbers (MRN)

-   ☐ Health plan beneficiary numbers

-   ☐ Account numbers

-   ☐ Certificate or license numbers

-   ☐ Vehicle identifiers (license plate numbers, VIN)

-   ☐ Device identifiers or serial numbers (pacemakers, insulin pumps,
    > etc.)

-   ☐ URLs

-   ☐ IP addresses

-   ☐ Biometric identifiers (fingerprints, retinal scans, voice prints)

-   ☐ Full-face photographs or comparable images

-   ☐ Any other unique identifying number, characteristic, or code

**Health Information:**

-   ☐ Diagnoses or diagnosis codes (ICD-10)

-   ☐ Treatment information

-   ☐ Medication names or dosages

-   ☐ Lab results or test values

-   ☐ Procedure codes (CPT, HCPCS)

-   ☐ Clinical notes or observations

-   ☐ Mental health information

-   ☐ Substance abuse treatment information

-   ☐ HIV/AIDS status

-   ☐ Genetic information

**If you checked ANY box → PHI is present and a BAA is required**

**Section 3: Data Flow Analysis**

**Question 4: Describe how data flows through Phase Mirror**

**For Platform (SaaS) customers:**

  Data Flow Point                                 Will PHI be present? (Yes/No/Unsure)   Description
  ----------------------------------------------- -------------------------------------- -------------
  Files uploaded to Phase Mirror Oracle                                                  
  API calls to Phase Mirror platform                                                     
  Configuration settings stored in Phase Mirror                                          
  Dissonance reports generated by Phase Mirror                                           
  Data shared with Phase Mirror support team                                             
  Calibration data (if opted in)                                                         

**For Consulting Services customers:**

  Data Flow Point                                    Will PHI be present? (Yes/No/Unsure)   Description
  -------------------------------------------------- -------------------------------------- -------------
  Documents shared during AI Governance Diagnostic                                          
  Information discussed in workshops                                                        
  System access provided to consultants                                                     
  Deliverables (specs, policies, reports)                                                   
  Email or Slack communications with consultants                                            

**Question 5: Data Minimization Assessment**

**Can you remove or de-identify PHI before it enters Phase Mirror?**

-   ☐ Yes, we can remove all 18 HIPAA identifiers

-   ☐ Yes, we can use synthetic or dummy data

-   ☐ No, PHI is necessary for the governance analysis

-   ☐ Unsure

**If \"No\" or \"Unsure\" → A BAA is required**

**If \"Yes\" → Complete the de-identification checklist below**

**Section 4: De-Identification Checklist**

*Complete this section ONLY if you answered \"Yes\" to Question 5*

**Safe Harbor Method**

To be considered de-identified under HIPAA\'s Safe Harbor method, you
must remove ALL 18 identifiers:

  Identifier                                       Removed?     How verified?
  ------------------------------------------------ ------------ ---------------
  1\. Names                                        ☐ Yes ☐ No   
  2\. Geographic subdivisions smaller than state   ☐ Yes ☐ No   
  3\. Dates (except year)                          ☐ Yes ☐ No   
  4\. Telephone numbers                            ☐ Yes ☐ No   
  5\. Fax numbers                                  ☐ Yes ☐ No   
  6\. Email addresses                              ☐ Yes ☐ No   
  7\. Social Security numbers                      ☐ Yes ☐ No   
  8\. Medical record numbers                       ☐ Yes ☐ No   
  9\. Health plan beneficiary numbers              ☐ Yes ☐ No   
  10\. Account numbers                             ☐ Yes ☐ No   
  11\. Certificate/license numbers                 ☐ Yes ☐ No   
  12\. Vehicle identifiers                         ☐ Yes ☐ No   
  13\. Device identifiers/serial numbers           ☐ Yes ☐ No   
  14\. URLs                                        ☐ Yes ☐ No   
  15\. IP addresses                                ☐ Yes ☐ No   
  16\. Biometric identifiers                       ☐ Yes ☐ No   
  17\. Full-face photos                            ☐ Yes ☐ No   
  18\. Other unique identifiers                    ☐ Yes ☐ No   

**Additional requirement:**

-   ☐ I certify that we have no actual knowledge that the remaining
    > information could be used alone or in combination to identify an
    > individual

**If ALL boxes are checked \"Yes\" → Data may be de-identified and a BAA
may not be required**

**If ANY box is \"No\" → PHI is present and a BAA is required**

**Section 5: Common Overlooked PHI Sources**

**IMPORTANT:** PHI can hide in unexpected places. Check if any of these
apply:

  Hidden PHI Source                                                  Present?     Notes
  ------------------------------------------------------------------ ------------ -------
  **File names** (e.g., \"john\_smith\_diagnosis.pdf\")              ☐ Yes ☐ No   
  **Variable names in code** (e.g., patient\_id, mrn\_lookup)        ☐ Yes ☐ No   
  **Comments in code** (e.g., \"// Fix bug for patient ID 12345\")   ☐ Yes ☐ No   
  **Log timestamps** combined with admission logs                    ☐ Yes ☐ No   
  **Error messages** containing patient identifiers                  ☐ Yes ☐ No   
  **URLs with patient parameters** (e.g., /patient?id=12345)         ☐ Yes ☐ No   
  **Database schema names** (e.g., patient\_records\_table)          ☐ Yes ☐ No   
  **API endpoint names** (e.g., /api/patient-demographics)           ☐ Yes ☐ No   
  **Email subjects or body text** in support tickets                 ☐ Yes ☐ No   
  **Screenshot filenames or metadata**                               ☐ Yes ☐ No   
  **Git commit messages** (e.g., \"Updated MRN validation\")         ☐ Yes ☐ No   
  **Slack/Teams messages** with Phase Mirror consultants             ☐ Yes ☐ No   

**If you checked \"Yes\" to ANY item → PHI is present and a BAA is
required**

**Section 6: Special Scenarios**

**Scenario A: Research and Development**

**Are you using Phase Mirror for:**

-   ☐ Drug discovery or clinical trials using patient data

-   ☐ Algorithm development with real patient outcomes

-   ☐ Research studies involving identifiable subjects

**If yes, answer:**

-   Do you have IRB approval? ☐ Yes ☐ No ☐ N/A

-   Is the data a Limited Data Set? ☐ Yes ☐ No ☐ Unsure

-   Do you have a Data Use Agreement? ☐ Yes ☐ No ☐ N/A

**If using identifiable patient data for research → A BAA is likely
required**

**Scenario B: Third-Party Data**

**Will Phase Mirror analyze AI systems that receive data from:**

-   ☐ EHR vendors (Epic, Cerner, etc.)

-   ☐ Health information exchanges (HIEs)

-   ☐ Other healthcare providers

-   ☐ Payers or health plans

**If yes:**

-   Do you have BAAs with those entities? ☐ Yes ☐ No ☐ Unsure

-   Will their PHI flow through Phase Mirror? ☐ Yes ☐ No ☐ Unsure

**If third-party PHI will flow through Phase Mirror → A BAA is
required**

**Scenario C: Aggregate or Summary Data**

**Will Phase Mirror only receive:**

-   ☐ Statistical summaries (e.g., \"1,000 patients with diabetes\")

-   ☐ Aggregate counts without individual records

-   ☐ Data grouped by categories (age ranges, not exact ages)

**Critical questions:**

-   Can any individual be identified from the aggregate data? ☐ Yes ☐ No

-   Are cell sizes smaller than 11 (making re-identification possible)?
    > ☐ Yes ☐ No

-   Could the aggregate data be combined with other information to
    > identify individuals? ☐ Yes ☐ No

**If you answered \"Yes\" to any critical question → PHI is present and
a BAA is required**

**Section 7: Final Determination**

**Automatic BAA Requirement**

**A BAA IS REQUIRED if you answered \"Yes\" or \"Unsure\" to ANY of the
following:**

-   \[ \] Any question in Section 2

-   \[ \] Any item in Section 3

-   \[ \] Question 5 (inability to de-identify)

-   \[ \] Any item in Section 5 (hidden PHI sources)

**De-Identification Route**

**A BAA MAY NOT be required ONLY if:**

-   \[ \] You completed Section 4 (De-Identification Checklist)

-   \[ \] You removed ALL 18 HIPAA identifiers

-   \[ \] You have no actual knowledge of re-identification risk

-   \[ \] You have a documented de-identification process

-   \[ \] Your legal/compliance team has approved this approach

**Section 8: Documentation and Next Steps**

**Your Determination**

Based on this worksheet:

-   ☐ **BAA REQUIRED** → Proceed to BAA execution

-   ☐ **BAA NOT REQUIRED** → Document de-identification process

-   ☐ **UNSURE** → Escalate to Phase Mirror compliance team

**Documentation Checklist**

If BAA not required (de-identification approach), attach:

-   \[ \] De-identification methodology document

-   \[ \] Sample of de-identified data

-   \[ \] Legal or compliance team approval

-   \[ \] Risk assessment documenting no re-identification risk

**Approval and Sign-Off**

**Completed by:**

Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Department: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Date:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Reviewed by (Privacy/Compliance Officer):**

Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Date:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Appendix A: Examples of PHI in AI Governance Contexts**

**Example 1: Configuration File with PHI**

\# ❌ CONTAINS PHI\
model\_config:\
training\_data: /data/patients/john\_smith\_records.csv\
patient\_id\_field: mrn\
validation\_set: 2024-01-15\_admissions.parquet

**Example 2: Configuration File WITHOUT PHI**

\# ✅ NO PHI\
model\_config:\
training\_data: /data/synthetic/dataset\_v2.csv\
identifier\_field: anonymous\_id\
validation\_set: 2024\_q1\_synthetic.parquet

**Example 3: Dissonance Report with PHI**

❌ CONTAINS PHI\
Dissonance detected: Patient ID 123456 received conflicting treatment\
recommendations on 2024-01-15. Dr. Smith approved override.

**Example 4: Dissonance Report WITHOUT PHI**

✅ NO PHI\
Dissonance detected: Treatment recommendation conflict in case\_id:\
abc-789. Manual override documented per protocol.

**Example 5: Code Comment with PHI**

\# ❌ CONTAINS PHI\
\# TODO: Fix validation for patient Mary Johnson (MRN 987654)\
def validate\_patient(patient\_data):\
pass

**Example 6: Code Comment WITHOUT PHI**

\# ✅ NO PHI\
\# TODO: Fix validation edge case documented in JIRA-1234\
def validate\_patient(patient\_data):\
pass

**Appendix B: When in Doubt, Execute the BAA**

**It\'s safer to have a BAA than to risk a HIPAA violation.**

**Red flags that mean \"execute the BAA\":**

-   Anyone on your team says \"I think there might be PHI\"

-   You\'re unsure about de-identification

-   Your legal team hasn\'t explicitly approved de-identification

-   You\'re in healthcare and analyzing healthcare AI systems

-   You can\'t definitively answer \"No\" to all PHI presence questions

**Remember:** A BAA protects both parties. There\'s no downside to
having one in place.

**Contact Information**

**Questions about this worksheet?**

Phase Mirror Compliance Team\
Email: \[compliance\@phasemirror.io\]\
Phone: \[Phone number\]

**Ready to execute a BAA?**

Phase Mirror Legal Team\
Email: \[legal\@phasemirror.io\]

**Revision History**

  Version   Date       Changes
  --------- ---------- -----------------
  1.0       \[Date\]   Initial release

**Additional Resources**

This worksheet is designed to be:

-   **Fillable PDF** - Allow customers to complete electronically

-   **Interactive** - Auto-calculate BAA requirement based on responses

-   **Printable** - For compliance documentation

Would you like me to create:

-   An interactive web version with conditional logic

-   A decision tree flowchart version

-   Email templates for sending to customers

-   A training video script explaining how to complete it

-   A simplified one-page version for quick screening?

⁂

1.  A Clear Guide to Phase Mirror\'s Services.pdf

2.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

3.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

4.  License\_ Strategic & Legal Analysis.pdf

5.  Phase Mirror\_ Consultation & SaaS.pdf

6.  Agentic Domain-Specific Reasoning.pdf

7.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

8.  The Phase Mirror does not resolve dissonance---it names it.pdf

9.  Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

10. The Phase of Mirror Dissonance.pdf

11. Implementation Guide\_ Applying Phase Mirror Dissonance.pdf
