Web Open PII, Sensitive PII, and PHI

Information submitted through webforms within Web Open is stored unencrypted. Due to this, webforms are secure for collecting Personally Identifiable Information (PII), but not Sensitive Personally Identifiable Information (SPII), Protected Health Information Data (PHI Data), HIPAA data (Health Insurance Portability and Accountability Act), or Payment Card Industry Data (PCI Data).

Do not request the following on any forms:

• Social Security numbers
• Driver's license numbers
• Medical information
• Passport numbers
• Passwords
• Financial information of any kind
  • Bank account information
  • Routing numbers
  • Credit card numbers
• Any SPII

The following information can be requested:

• A name, including the full name of the individual, their maiden name, and any alias they may use
• Email addresses and physical addresses such as street addresses, zip codes, and county
• Telephone and fax numbers
• Vehicle identifiers and serial numbers, including license plate numbers
• Information about an individual that is linked to their place of birth, date of birth, religion, activities, geographical indicators, or educational data
• Asset information, such as MAC address or IP, as well as other static identifiers that could consistently link a particular person
• Device identifiers and serial number

Definitions

• Personally Identifiable Information (PII) has numerous official definitions, depending on what agency or state law/policy you read, but in general, it is defined as any information that can be used to identify an individual directly or indirectly, such as a name, email address, Social Security Number or IP address.

• Sensitive PII (SPII) is generally defined as any PII that if lost, stolen, or disclosed without authorization could result in significant harm to an individual. 

• Protected Health Information (PHI) is a specific type of Sensitive PII that is collected by a healthcare provider or other covered entity for the provision of healthcare services. This information is protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which requires HIPAA-covered entities and their business associates to implement specific technical and operational safeguards to protect PHI.

Return to Article Navigation

Identification

The PII, Sensitive PII, and PHI identification charts below were compiled from information gathered from the Department of Homeland Security’s Handbook for Safeguarding Sensitive Personally Identifiable Information and the U.S. Department of Health and Human Services.

Personally Identifiable Information (PII)

• Email
• Home Address
• IP Address
• Name
• Phone Number
• Any other information that can uniquely identify someone

Sensitive PII (SPII)

Protected Health Information (PHI)

Health Information (physical, electronic, or spoken) + Identifier + collected by a HIPAA-Covered Entity or School or University or Employer or Business Associate of a HIPAA-Covered Entity + in relation to the provision of healthcare or payment for healthcare services.

Return to Article Navigation

Web Open Webforms Disclaimer

Disclaimer: The information to be submitted on this form will be sent via email and stored in the database unencrypted. To protect sensitive information and comply with applicable data security requirements, do not request the following information on this form: Social Security numbers, driver's license numbers, medical information, passport numbers, passwords, or financial information of any kind, including, without limitation, bank account information, routing numbers, credit card number. If you intend to collect sensitive information, please reach out to your account manager to discuss CivicPlus's secure form offerings.

IN ORDER TO MAINTAIN COMPLIANCE WITH DATA SECURITY REQUIREMENTS, CIVICPLUS MAY, AT ANY TIME AND IN ITS SOLE DISCRETION, UNPUBLISH ANY FORM THAT SOLICITS SENSITIVE INFORMATION WITH OR WITHOUT NOTICE TO YOU.

Return to Article Navigation