{"id":15087,"date":"2021-09-23T12:36:11","date_gmt":"2021-09-23T16:36:11","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=15087"},"modified":"2025-03-11T14:26:52","modified_gmt":"2025-03-11T18:26:52","slug":"masking-phi-in-hl7-and-x12-files","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/","title":{"rendered":"Finding and Masking PHI in HL7 and X12 Files"},"content":{"rendered":"<p><em><strong>Editors Note<\/strong>: This article demonstrates the discovery and de-identification of Protected Health Information (PHI) in EDI files using the DarkShield <strong>API<\/strong> for Files. If you are interested in using the <span style=\"text-decoration: underline;\">fit-for-purpose search\/mask <strong>graphical wizards<\/strong><\/span> in DarkShield instead, see <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-edi-files-with-darkshield\/\">this<\/a> article on HL7 masking, <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-x12-edi-files-with-darkshield\/\">this<\/a> article on X12 masking, or <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-fhir-edi-files-with-darkshield\/\">this<\/a> article on FHIR masking.<\/em><\/p>\n<p>IRI\u2019s reputation in the <a href=\"https:\/\/www.iri.com\/customers\/industries\/healthcare\">healthcare industry<\/a> expanded from its traditional roots in claims data processing in 2010, when it released <a href=\"https:\/\/www.iri.com\/products\/fieldshield\">IRI FieldShield<\/a> to find and de-identify Protected Health Information (PHI) in flat files and relational databases. A number of PHI de-identification and anonymization capabilities in this tool helps healthcare providers and business associates comply with HIPAA Safe Harbor and Expert Determination Method <a href=\"https:\/\/www.iri.com\/solutions\/data-masking\/hipaa\">security rules<\/a>.<\/p>\n<p>IRI introduced the <a href=\"https:\/\/www.iri.com\/products\/darkshield\">DarkShield<\/a> data masking product in 2017 to address these requirements in semi- and unstructured data sources, including XML, Excel, and PDF files, as well as NoSQL DBs like Mongo and image formats like JPEG and <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-dicom-darkshield-api\/\">DICOM<\/a>. This article covers DarkShield support for HL7 and X12 EDI formats through its <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/darkshield-files-rpc-api\/\">RPC API for files<\/a>.<\/p>\n<h6><b>What is HL7?<\/b><\/h6>\n<p>The Health Level Seven (HL7) document format has been a standards-based \u201cframework for the exchange, integration, sharing, and retrieval of electronic health information\u201d for more than 30 years. There are several HL7 file standards in use today, including the:<\/p>\n<ul>\n<li aria-level=\"1\">Version 2.x messaging standard for health and medical transactions;<\/li>\n<li aria-level=\"1\">Version 3 as the next generation of messaging standards;<\/li>\n<li aria-level=\"1\">Clinical Document Architecture (CDA), the exchange model for clinical documents;<\/li>\n<li aria-level=\"1\">Continuity of Care Documents (CCD), for the exchange of medical summaries; and,<\/li>\n<li aria-level=\"1\">Fast Healthcare Interoperability Resources (FHIR), for health care data exchange.<\/li>\n<\/ul>\n<h6><b>HL7 Message Structure<\/b><\/h6>\n<p><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/HL7_img.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15103 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/HL7_img.png\" alt=\"\" width=\"600\" height=\"48\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/HL7_img.png 600w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/HL7_img-300x24.png 300w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/a><\/p>\n<p>A HL7 message is strictly structured, and can be broken down into segments, composites (fields) within segments, and sub-composites (sub-fields). An HL7 message must always start with a message header segment (MSH).<\/p>\n<p>The HL7 MSH segment contains information about the message, including what delimiters will be used in the message (e.g. \u2018|^~\\&amp;\u2019). Each line starts with a new segment and has a segment identifier (e.g. PID, MSA, NK1) at the beginning of the segment.<\/p>\n<p>The composites within the segment are separated by the pipe delimiter in this example (default composite delimiter is \u201c|\u201d). The sub-composite delimiter in this example is a caret character (\u201c^\u201d).<\/p>\n<ol>\n<li aria-level=\"1\">Composite delimiter &#8211; \u201c|\u201d<\/li>\n<li aria-level=\"1\">Sub-composite delimiter &#8211; \u201c^\u201d<\/li>\n<li aria-level=\"1\">Separates repeating fields &#8211; \u201c~\u201d<\/li>\n<li aria-level=\"1\">Escape character &#8211; \u201c\\\u201d<\/li>\n<li aria-level=\"1\">\u00a0Sub-sub-composite delimiter &#8211; \u201c&amp;\u201d<\/li>\n<\/ol>\n<p><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-logo.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15109 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-logo.png\" alt=\"\" width=\"225\" height=\"225\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-logo.png 225w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-logo-150x150.png 150w\" sizes=\"(max-width: 225px) 100vw, 225px\" \/><\/a><\/p>\n<h6><b>What is X12?<\/b><\/h6>\n<p>X12 is a common format for electronic business documents, and has also been used in the healthcare industry since the Accredited Standards Committee (ASC) created it in 1979. Every X12 document has a three-digit identifier to notify the receiver of what information it contains.<\/p>\n<p>For example:<\/p>\n<ul>\n<li aria-level=\"1\">The X12 810 is a transaction set for an invoice.<\/li>\n<li aria-level=\"1\">The X12 835 Health Care Claim and Remittance Advice transaction set specified by HIPAA 5010 requirements for electronic transmission of healthcare payment and benefit information.<\/li>\n<li aria-level=\"1\">The X12 837 Health Care Medical Claims transaction set that is formatted to meet HIPAA requirements for electronic submission of healthcare information.<\/li>\n<li aria-level=\"1\">The X12 850 is a transmission for a purchase order.<\/li>\n<\/ul>\n<p><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-logo.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15102 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-logo.png\" alt=\"\" width=\"363\" height=\"139\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-logo.png 363w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-logo-300x115.png 300w\" sizes=\"(max-width: 363px) 100vw, 363px\" \/><\/a><\/p>\n<h6><b>X12 Message Structure<\/b><\/h6>\n<p><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12_img.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15101 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12_img.png\" alt=\"\" width=\"650\" height=\"411\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12_img.png 862w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12_img-300x190.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12_img-768x486.png 768w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a><\/p>\n<p>Like an HL7 message, an X12 message has a strict structure consisting of segments, elements (fields), and composite elements (sub-fields). An X12 message must always start with an Interchange control header (ISA segment).<\/p>\n<p>The ISA segment contains information about the message including a list of delimiters place at the end of the ISA segment (e.g. \u2018*:~\u2019). Directly following an ISA segment is the Functional Group Header segment(GS) which is also called the inner envelope.<\/p>\n<p>Unlike an HL7 message, each X12 segment does not need to be followed by a carriage return or line feed. Instead X12 segments have segment delimiters.<\/p>\n<p>In this example, the end-of-segment delimiter is the tilde (\u201c~\u201d). Like HL7, each segment has a segment identifier (e.g. N1, AMT) at the beginning of the segment. The elements within the segment are separated by a special character; in this example it is an asterisk (default element delimiter is \u201c*\u201d). The composite delimiter in this example is a colon character (\u201c:\u201d).<\/p>\n<p>For this example the delimiters of the X12 document are the following:<\/p>\n<ol>\n<li aria-level=\"1\">Elements delimiter &#8211; \u201c*\u201d<\/li>\n<li aria-level=\"1\">Composite element delimiter &#8211; \u201c:\u201d<\/li>\n<li aria-level=\"1\">End of segment delimiter &#8211; \u201c~\u201d<\/li>\n<\/ol>\n<h6><b>Sensitive Data in HL7 and X12 Documents<\/b><\/h6>\n<p>It is no surprise that HL7 documents focused on relaying information in the healthcare industry, and X12 messages similarly involved in multiple business sectors, may carry sensitive information like protected health information (PHI) within the body of their respective documents.<\/p>\n<p>This leads to security issues especially when storing these documents. Forbes made a comment in particular about HL7, \u201cfrom the start, HL7 was arguably built insecurely, making it unsuitable for the public cloud by itself\u201d.<\/p>\n<h6><b>How IRI DarkShield Can Help<\/b><\/h6>\n<p>The challenge of being able to store data securely is a challenge with which many businesses and regulators are well acquainted. With the latest additions to the <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/darkshield-files-rpc-api\/\">IRI DarkShield <i>Files API<\/i><\/a>, locating and de-identifying key identifiers in both HL7 v2 and X12 documents is now possible; HL7 v3 was <a href=\"https:\/\/github.com\/TeamIRI\/darkshield-api-demos\/tree\/master\/json-xml\">already supported<\/a> by virtue of its XML format.<\/p>\n<p>DarkShield already finds and masks PHI and other sensitive data in structured, semi-structured, and unstructured data sources (including DICOM images). Adding support for HL7 and X12 through its <i>Files API<\/i>, provides a callable way to improve security and compliance with data privacy regulations like HIPAA.<\/p>\n<p>DarkShield supports multiple search methods, and uses the same <a href=\"https:\/\/www.iri.com\/solutions\/data-masking\/static-data-masking\">static masking<\/a> functions as <a href=\"https:\/\/www.iri.com\/products\/fieldshield\">IRI FieldShield<\/a> to preserve data integrity enterprise-wide.<\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2021\/01\/DarkShield-files-api-diagram.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-14221 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/01\/DarkShield-files-api-diagram.png\" alt=\"\" width=\"500\" height=\"338\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/01\/DarkShield-files-api-diagram.png 861w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/01\/DarkShield-files-api-diagram-300x203.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/01\/DarkShield-files-api-diagram-768x519.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<h6><b>Configuring HL7 and X12 DarkShield Files API Calls<\/b><\/h6>\n<p>In the DarkShield<i> Files API<\/i> samples for <a href=\"https:\/\/github.com\/TeamIRI\/darkshield-api-demos\/tree\/master\/hl7\">HL7<\/a> and <a href=\"https:\/\/github.com\/TeamIRI\/darkshield-api-demos\/tree\/master\/x12\">X12<\/a> formats, you can see that the file, and content-type of the file, to be searched are specified in <i>main.py<\/i> in a manner like this:<\/p>\n<p style=\"text-align: center;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-x12-processfiles.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15091 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-x12-processfiles.png\" alt=\"\" width=\"416\" height=\"32\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-x12-processfiles.png 416w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-x12-processfiles-300x23.png 300w\" sizes=\"(max-width: 416px) 100vw, 416px\" \/><\/a><i>Demonstration of X12 file content-type.<\/i><\/p>\n<p>For the DarkShield Files API to know what format the messages are expected to be in the content-type must be <i>text\/hl7<\/i> and <i>text\/x12<\/i> respectively.<\/p>\n<h6><b>Selecting Specific Segments and Fields to Mask<\/b><\/h6>\n<p>Usually the DarkShield<i> Files API<\/i> will search and mask an entire file based on what is found by the searchMatchers. That said, there are instances when a user may wish for masking to be more specific. An example would be that not all names in a HL7 document may need masking,\u00a0 and a particular name might need to be referenced later.<\/p>\n<p>To accomplish masking of specific segments and their fields a Column Matcher is specified in the file_search_context. Below is a sample configuration for HL7 v2 and X12:<\/p>\n<p style=\"text-align: center;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextHl7.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15092 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextHl7.png\" alt=\"\" width=\"335\" height=\"650\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextHl7.png 335w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextHl7-155x300.png 155w\" sizes=\"(max-width: 335px) 100vw, 335px\" \/><\/a><em>HL7 fileSearchContext of setup.py file.<\/em><\/p>\n<p>When targeting specific columns on a segment, note that the syntax for the column matcher uses a pipe delimiter to separate the segment identifier from the target column. Regardless of whether a pipe delimiter is used as a field delimiter in the document, this will be the syntax to indicate specific segments and columns to be masked by the API.<\/p>\n<p style=\"text-align: center;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextX12.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15090 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextX12.png\" alt=\"\" width=\"308\" height=\"559\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextX12.png 308w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/fileSearchContextX12-165x300.png 165w\" sizes=\"(max-width: 308px) 100vw, 308px\" \/><\/a><em>X12 fileSearchContext of setup.py file<\/em><\/p>\n<p>When targeting specific columns on a segment, note that the syntax for the column matcher uses an asterisk delimiter to separate the segment identifier from the target column. Regardless of whether an asterisk delimiter is used as a field delimiter in the document, this will be the syntax to indicate specific segments and columns to be masked by the API.<\/p>\n<p>Note that the <i>ISA segment and GS segment are mandatory<\/i> for the DarkShield API to correctly parse the X12 message.<\/p>\n<h6><strong>Before and After Screenshots<\/strong><\/h6>\n<p><span style=\"color: #000000;\"><b>HL7 v2 Before Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-data.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15099 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-data.png\" alt=\"\" width=\"647\" height=\"81\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-data.png 886w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-data-300x38.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-data-768x96.png 768w\" sizes=\"(max-width: 647px) 100vw, 647px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>HL7 v2 After Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-masked.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15100 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/hl7-masked.png\" alt=\"\" width=\"649\" height=\"81\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-masked.png 889w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-masked-300x37.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/hl7-masked-768x96.png 768w\" sizes=\"(max-width: 649px) 100vw, 649px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>X12 835 Before Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-835-data.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15096 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-835-data.png\" alt=\"\" width=\"651\" height=\"405\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-835-data.png 866w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-835-data-300x187.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-835-data-768x478.png 768w\" sizes=\"(max-width: 651px) 100vw, 651px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>X12 835 After Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-835-masked.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15097 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-835-masked.png\" alt=\"\" width=\"650\" height=\"410\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-835-masked.png 863w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-835-masked-300x189.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-835-masked-768x484.png 768w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>X12 837 Before Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-837-data.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15098 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-837-data.png\" alt=\"\" width=\"650\" height=\"544\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-837-data.png 860w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-837-data-300x251.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-837-data-768x643.png 768w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>X12 837 After Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-837-masked.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15093 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-837-masked.png\" alt=\"\" width=\"650\" height=\"543\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-837-masked.png 862w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-837-masked-300x251.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-837-masked-768x641.png 768w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>X12 850 Before Masking:<\/b><\/span><\/p>\n<p><span style=\"color: #000000;\"><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-850-data.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15094 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-850-data.png\" alt=\"\" width=\"650\" height=\"261\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-850-data.png 864w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-850-data-300x120.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-850-data-768x308.png 768w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a><\/span><\/p>\n<p><span style=\"color: #000000;\"><b>X12 850 After Masking:<\/b><\/span><\/p>\n<p><a href=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-850-masked.png\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-15095 aligncenter\" src=\"\/blog\/wp-content\/uploads\/2021\/10\/x12-850-masked.png\" alt=\"\" width=\"650\" height=\"263\" srcset=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-850-masked.png 867w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-850-masked-300x121.png 300w, https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/x12-850-masked-768x311.png 768w\" sizes=\"(max-width: 650px) 100vw, 650px\" \/><\/a><\/p>\n<h6><b>In Closing<\/b><\/h6>\n<p>Because HL7 and X12 documents are highly insecure when in a public cloud, the threat of a data privacy breach is significant. To prevent data privacy law violations there is a need to protect the sensitive data within these documents.<\/p>\n<p>The latest enhancements to the <i>DarkShield<\/i>&#8211;<i>Files API <\/i>address these needs for HL7v2 and X12 documents. Thus, by providing additional levels of data security for stored electronic documents, <a href=\"https:\/\/www.iri.com\/products\/darkshield\">IRI DarkShield<\/a> adds an additional layer of security to protected health information.<\/p>\n<p><em>If you are interested in using the\u00a0fit-for-purpose search\/mask\u00a0<strong>graphical wizards<\/strong> in DarkShield which use segment classification, see <a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-edi-files-with-darkshield\/\">this<\/a>\u00a0article on HL7 masking,\u00a0<a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-x12-edi-files-with-darkshield\/\">this<\/a>\u00a0article on X12 masking, or\u00a0<a href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-fhir-edi-files-with-darkshield\/\">this<\/a>\u00a0article on FHIR masking.<\/em><\/p>\n<h6><b>Citations<\/b><\/h6>\n<p><i>Health Level Seven international<\/i>. HL7 International. (n.d.). Retrieved October 20, 2021, from <a href=\"https:\/\/www.hl7.org\/implement\/standards\">https:\/\/www.hl7.org\/implement\/standards<\/a>\/.<\/p>\n<p>Ferrari, M. (2019, July 12). <i>Council Post: HL7: Is your sensitive data secure?<\/i> Forbes. Retrieved October 20, 2021, from <a href=\"https:\/\/www.forbes.com\/sites\/forbestechcouncil\/2019\/07\/12\/hl7-is-your-sensitive-data-secure\/?sh=40f121ca678d\">https:\/\/www.forbes.com\/sites\/forbestechcouncil\/2019\/07\/12\/hl7-is-your-sensitive-data-secure\/?sh=40f121ca678d<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Editors Note: This article demonstrates the discovery and de-identification of Protected Health Information (PHI) in EDI files using the DarkShield API for Files. If you are interested in using the fit-for-purpose search\/mask graphical wizards in DarkShield instead, see this article on HL7 masking, this article on X12 masking, or this article on FHIR masking. IRI\u2019s<\/p>\n<div><a class=\"btn-filled btn\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\" title=\"Finding and Masking PHI in HL7 and X12 Files\">Read More<\/a><\/div>\n","protected":false},"author":152,"featured_media":15107,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[8],"tags":[1494,1496,1976,603,1260,1412,1267,1266,1669,1388,412,1549,1550,1877,1410,1668],"class_list":["post-15087","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection","tag-darkshield-api","tag-darkshield-rpc-api","tag-fhir-data-masking","tag-hipaa","tag-hl7","tag-hl7-data-masking","tag-hl7-message-encryption","tag-hl7-message-masking","tag-hl7-test-data","tag-iri-darkshield","tag-phi","tag-phi-masking","tag-x12","tag-x12-edi","tag-x12-phi","tag-x12-test-data"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.4 (Yoast SEO v23.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Finding and Masking PHI in HL7 and X12 Files - IRI<\/title>\n<meta name=\"description\" content=\"Learn how to use the IRI DarkShield RPC API for files to de-identify PHI in HL7 and X12 files or our other articles on doing that in the GUI.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Finding and Masking PHI in HL7 and X12 Files\" \/>\n<meta property=\"og:description\" content=\"Learn how to use the IRI DarkShield RPC API for files to de-identify PHI in HL7 and X12 files or our other articles on doing that in the GUI.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-23T16:36:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-11T18:26:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1110\" \/>\n\t<meta property=\"og:image:height\" content=\"740\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Adam Lewis\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Adam Lewis\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\"},\"author\":{\"name\":\"Adam Lewis\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/37c0e5beab094bd61cc521902df2876e\"},\"headline\":\"Finding and Masking PHI in HL7 and X12 Files\",\"datePublished\":\"2021-09-23T16:36:11+00:00\",\"dateModified\":\"2025-03-11T18:26:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\"},\"wordCount\":1418,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg\",\"keywords\":[\"Darkshield API\",\"DarkShield RPC API\",\"FHIR Data Masking\",\"HIPAA\",\"HL7\",\"HL7 data masking\",\"HL7 message encryption\",\"HL7 message masking\",\"hl7 test data\",\"IRI DarkShield\",\"PHI\",\"PHI masking\",\"X12\",\"X12 EDI\",\"X12 PHI\",\"x12 test data\"],\"articleSection\":[\"Data Masking\/Protection\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\",\"url\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\",\"name\":\"Finding and Masking PHI in HL7 and X12 Files - IRI\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg\",\"datePublished\":\"2021-09-23T16:36:11+00:00\",\"dateModified\":\"2025-03-11T18:26:52+00:00\",\"description\":\"Learn how to use the IRI DarkShield RPC API for files to de-identify PHI in HL7 and X12 files or our other articles on doing that in the GUI.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg\",\"width\":1110,\"height\":740},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Finding and Masking PHI in HL7 and X12 Files\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/37c0e5beab094bd61cc521902df2876e\",\"name\":\"Adam Lewis\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/087667d0c75d33bb6fab6e734bd89333?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/087667d0c75d33bb6fab6e734bd89333?s=96&d=blank&r=g\",\"caption\":\"Adam Lewis\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/adaml\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Finding and Masking PHI in HL7 and X12 Files - IRI","description":"Learn how to use the IRI DarkShield RPC API for files to de-identify PHI in HL7 and X12 files or our other articles on doing that in the GUI.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/","og_locale":"en_US","og_type":"article","og_title":"Finding and Masking PHI in HL7 and X12 Files","og_description":"Learn how to use the IRI DarkShield RPC API for files to de-identify PHI in HL7 and X12 files or our other articles on doing that in the GUI.","og_url":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/","og_site_name":"IRI","article_published_time":"2021-09-23T16:36:11+00:00","article_modified_time":"2025-03-11T18:26:52+00:00","og_image":[{"width":1110,"height":740,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg","type":"image\/jpeg"}],"author":"Adam Lewis","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Adam Lewis","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/"},"author":{"name":"Adam Lewis","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/37c0e5beab094bd61cc521902df2876e"},"headline":"Finding and Masking PHI in HL7 and X12 Files","datePublished":"2021-09-23T16:36:11+00:00","dateModified":"2025-03-11T18:26:52+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/"},"wordCount":1418,"commentCount":1,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg","keywords":["Darkshield API","DarkShield RPC API","FHIR Data Masking","HIPAA","HL7","HL7 data masking","HL7 message encryption","HL7 message masking","hl7 test data","IRI DarkShield","PHI","PHI masking","X12","X12 EDI","X12 PHI","x12 test data"],"articleSection":["Data Masking\/Protection"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/","url":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/","name":"Finding and Masking PHI in HL7 and X12 Files - IRI","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg","datePublished":"2021-09-23T16:36:11+00:00","dateModified":"2025-03-11T18:26:52+00:00","description":"Learn how to use the IRI DarkShield RPC API for files to de-identify PHI in HL7 and X12 files or our other articles on doing that in the GUI.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg","width":1110,"height":740},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-phi-in-hl7-and-x12-files\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Finding and Masking PHI in HL7 and X12 Files"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/37c0e5beab094bd61cc521902df2876e","name":"Adam Lewis","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/087667d0c75d33bb6fab6e734bd89333?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/087667d0c75d33bb6fab6e734bd89333?s=96&d=blank&r=g","caption":"Adam Lewis"},"url":"https:\/\/www.iri.com\/blog\/author\/adaml\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2021\/10\/national-cancer-institute-L8tWZT4CcVQ-unsplash.jpg","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/15087"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/152"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=15087"}],"version-history":[{"count":11,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/15087\/revisions"}],"predecessor-version":[{"id":18266,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/15087\/revisions\/18266"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/15107"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=15087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=15087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=15087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}