Policies / POLICY

Detect HIPAA Violations in Microsoft OneDrive and Remediate

This is a DLP policy template that you can implement easily in the Nightfall platform.

Description	Detect and automatically notify when protected health information (PHI) is found in OneDrive accessible outside the organization or via public link. Automatically restrict access to the Owner.
Integration	Microsoft OneDrive
Use Case	Safeguard Personal Information
Output Settings	Alert admins in Slack or Teams, automatically restrict access to Owner, recommend configuring alerting to SIEM, and alert end-user with remediation instructions and educational messaging to proper handling of senstive patient health information handling to prevent future exposure.
Inclusions	Include drives and special folders you want to monitor. Scope permissions to files accessible outside the organization or via public link.
Exclusions	Select drives, folder paths, and file extensions you don't want to scan.

Applied Detection Rules

These are the detection rules that will be applied within this policy, defining what types of sensitive data the policy is looking for.

Protected Health Information (PHI)

Aims to prevent the exposure of sensitive patient health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA). Detects data that uniquely identifies an individual in combination with a diagnostic indicator such as medication, diagnosis, and procedure.