HL7 Health Message
Detects HL7 Health Message patterns. Detects HL7v2 message headers and ADT event types
- Type
- regex
- Engine
- universal
- Confidence
- low
- Confidence justification
- Low confidence: generic pattern format that may match unrelated data. Corroborative evidence keywords are essential for reliable detection. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Verified
- Jurisdictions
- global
- Frameworks
- ISO 27001, ISO 27701, SOC 2
- Data categories
- phi, healthcare
- Scope
- specific
- Risk rating
- 9
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible
Pattern
\bMSH\|Corroborative evidence keywords
MRN, medical record number, patient ID, NPI, DEA, medicare, medicaid, insurance ID, member ID, beneficiary, ICD-10, ICD-9, CPT, NDC, SNOMED, HCPCS, diagnosis code, procedure code, drug code, field (+28 more)
Proximity: 300 characters
Should match
MSH|^~\&|SendingApp— HL7 message header segmentMSH|^~\&|HIS|Hospital|LAB|Lab— HL7 header with sending and receiving applicationsMSH|^~\&|ADT|MCM— HL7 ADT message header
Should not match
MSA|AA|12345— MSA segment header instead of MSHPID|1||12345— PID segment instead of MSHmsh|^~\&|App— Lowercase msh (pattern is case-sensitive)template example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Medical terminology in health education materials, research publications, clinical guidelines, or public health documents without patient-specific data. Mitigation: Require corroborative evidence keywords confirming patient context. Look for co-occurrence with patient identifiers such as medical record numbers or dates of birth.
- General wellness and fitness content using medical vocabulary without constituting protected health information. Mitigation: Layer with patient identifier patterns or healthcare-specific document structure detection to distinguish clinical records from general health content.