Use this before a security risk analysis, when a new system, integration or vendor touches health data, or when nobody can say with confidence which systems hold it. You get three files in a new folder, ./phi-flow-mapping/: a spreadsheet you can open in Excel listing every place health data enters, sits or leaves, with its safeguards (phi-inventory.csv), simple diagrams of how the data moves (flows.md), and a list of the protection gaps found, each with a proposed owner (safeguard-gaps.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The privacy and security officers confirm the map and own the decisions on gaps.

Inputs to gather

Read the system inventory, architecture and integration diagrams, the vendor list with business associate agreement status, field lists for patient-facing systems, logging and backup configuration, and the last risk analysis. Ask the reader, in one message: whether the company is a covered entity, a business associate or both, which products and teams touch health data, and whether paper or fax is still in use.

Step 1: define what counts

Write down the health data categories in scope (clinical, billing, identifiers linked to care, sensitive categories such as mental health) and which identifiers make data identifiable. Note what the company treats as de-identified and how. HIPAA recognises two methods under 45 CFR 164.514(b): an expert determination, or the safe harbor method. Safe harbor has two parts, and both need evidence in the inventory: the listed identifiers of the individual and of their relatives, employers and household members are removed, and the company has no actual knowledge that what remains could identify the person, alone or combined with other data (HHS de-identification guidance). Data only "masked" or "anonymised" by internal convention stays in scope until one method is shown in full. Teams often miss dates and ages over 89, and a re-identification code may not be derived from the identifiers (164.514(c)). Flag any flow carrying records from a federally assisted substance use disorder program: 42 CFR Part 2 adds stricter consent and redisclosure rules, so counsel reviews those flows.

Step 2: trace each flow through five stages

For each product or business process, follow the data:

Enters: portals, intake forms, provider integrations, claims feeds, uploads, phone, email, fax.
Moves: internal services, integrations, exports, reports, messages between teams.
Rests: primary stores, and the hidden copies: backups, replicas, logs and error trackers capturing request bodies, analytics warehouses, support tickets, inboxes, chat, laptops, test copies, and AI tools staff paste text into.
Leaves: disclosures to business associates, payers, providers, public health or research, and tracking technologies on patient pages (check current HHS guidance on those).
Ends: retention, deletion, media disposal, return or destruction when a vendor contract ends.