> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# PHI/PII Classification (CL & PM Tables)

> Version: 1.0.0 Last Updated: 2026-02-18 Source: CL-PM-SPEC-REVIEW Finding 8.3

**Version:** 1.0.0\
**Last Updated:** 2026-02-18\
**Source:** CL-PM-SPEC-REVIEW Finding 8.3

This document classifies CL and PM database tables by data sensitivity for access control, logging, and compliance. **PHI** = protected health information; **PII** = personally identifiable information; **SUD** = substance use disorder (42 CFR Part 2–protected when applicable).

***

## Classification Levels

| Level       | Meaning                                                            | Logging / Sharing                                                            |
| ----------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
| **PHI**     | Health information that identifies or could identify an individual | Never in logs; never to external AI; encrypt at rest and in transit          |
| **PII**     | Non-health identifiers (name, SSN, contact)                        | Never in logs; last-4 SSN only where required (e.g. PM); full SSN in vault   |
| **SUD**     | Substance use disorder treatment information                       | 42 CFR Part 2; consent required for disclosure; treat as highest sensitivity |
| **General** | No direct identifier (e.g. aggregate, codes only)                  | Org/site/user IDs and codes OK in logs per policy                            |

***

## CL Tables

| Table                 | Classification | Notes                                                            |
| --------------------- | -------------- | ---------------------------------------------------------------- |
| cl\_patient\_charts   | PHI            | Links to patient; chart content PHI                              |
| cl\_problems          | PHI            | Diagnosis and problem list                                       |
| cl\_assessments       | PHI / SUD      | Full assessment may include SUD; consent required for disclosure |
| cl\_treatment\_plans  | PHI            | Goals and interventions                                          |
| cl\_progress\_notes   | PHI / SUD      | Note content; SUD if substance use documented                    |
| cl\_medications       | PHI            | Medication list                                                  |
| cl\_prescriptions     | PHI            | Prescription details                                             |
| cl\_consents          | PHI / SUD      | Consent scope may reference SUD                                  |
| cl\_disclosure\_log   | PHI            | Disclosure events; no content in logs                            |
| cl\_risk\_screenings  | PHI            | Suicide risk, etc.                                               |
| cl\_safety\_plans     | PHI            | Safety plan content                                              |
| cl\_group\_sessions   | PHI            | Session and attendance                                           |
| cl\_group\_attendance | PHI            | Individual response may be SUD                                   |
| cl\_crisis\_episodes  | PHI            | Crisis documentation                                             |
| cl\_sdoh\_screenings  | PHI            | Social needs responses                                           |
| cl\_social\_referrals | PHI            | Referral and outcome                                             |
| cl\_peer\_encounters  | PHI / SUD      | Peer service may involve SUD                                     |
| cl\_outcome\_measures | PHI            | PROMs and scores                                                 |
| cl\_pdmp\_queries     | PHI            | Query/response; log query\_id only, no response content          |

***

## PM Tables

| Table                     | Classification | Notes                                                     |
| ------------------------- | -------------- | --------------------------------------------------------- |
| pm\_patients              | PHI / PII      | Demographics; SSN last-4 only in table; full SSN in vault |
| pm\_insurance\_policies   | PHI / PII      | Member ID, subscriber info                                |
| pm\_eligibility\_checks   | PHI            | Benefit and eligibility                                   |
| pm\_appointments          | PHI            | Appointment and patient link                              |
| pm\_encounters            | PHI            | Encounter and patient link                                |
| pm\_charges               | PHI            | Charge and diagnosis/procedure codes                      |
| pm\_claims                | PHI            | Claim and line items                                      |
| pm\_payments              | PHI            | Payment and patient/claim                                 |
| pm\_prior\_authorizations | PHI            | Auth and patient                                          |
| pm\_messages              | PHI / SUD      | Message content may be SUD                                |
| pm\_portal\_users         | PII            | Link to patient; no PHI in table                          |
| pm\_telehealth\_sessions  | PHI            | Session and patient link                                  |

***

## PF Tables (Clinical/PM Boundary)

| Table                   | Classification | Notes                      |
| ----------------------- | -------------- | -------------------------- |
| pf\_patient\_identities | PII (minimal)  | MRN and org only; no names |

***

## References

* [constitution.md](../../constitution.md) §4 (PHI/PII)
* [CL-11 Consent & 42 CFR Part 2](../../specs/cl/specs/CL-11-consent-management-42cfr-part2.md)
* [REGULATORY\_COMPLIANCE\_TRACKER.md](./REGULATORY_COMPLIANCE_TRACKER.md)