Canada Personal Health Identification Number (PHIN)

Detects Canada Personal Health Identification Number (PHIN) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Due to the generic numeric format, corroborative evidence keywords are essential for reliable detection.

Type

regex

Engine

universal

Confidence

medium

Confidence justification

Medium confidence: nine-digit numbers are extremely common. PHIN detection requires corroborative evidence such as 'personal health identification number' or 'Manitoba Health' nearby. Context label evidence plus explicit template/example exclusion improves precision for high-risk identifiers.

Detection quality

Verified

Jurisdictions

ca

Regulations

FIPPA, Law 25 (QC), PHIPA, PIPEDA

Frameworks

ISO 27001, ISO 27701, SOC 2

Data categories

phi, health, government-id

Scope

narrow

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\b\d{9}\b

Corroborative evidence keywords

PHIN, personal health, health identification, Manitoba Health, health number, health card, provincial health, carte santé, health card number, numéro de santé, OHIP, patient number, carte sante, health identification number, health insurance, health insurance number, health plan, health service, health service number, health services (+14 more)

Proximity: 300 characters

Should match

• 123456789 — Nine-digit PHIN format
• 987654321 — Nine-digit personal health identification number
• 112233445 — Nine-digit health ID number

Should not match

• 12345678 — Eight digits, too short for PHIN
• 1234567890 — Ten digits, exceeds PHIN format
• sample template placeholder number 12345678 — Template/sample context negative — the embedded number is 8 digits, one short of the required 9, so the universal-engine top-level regex correctly does not match it (template gating is a Purview-tier NOT-group concern, not expressible in a bare regex)

Known false positives

• Generic numeric sequences matching the digit pattern in non-health contexts Mitigation: Require corroborative evidence keywords within the proximity window to distinguish health identifiers from general numeric data.
• Reference numbers or account identifiers from other domains with similar digit counts Mitigation: Layer with document classification to prioritise matches in health and medical documents.

References

• Canada Personal Health Identification Number (PHIN) entity definition - Microsoft Learn