Privacy Exposure Assessment

This is what we found — and what it puts at risk.

A complete account of the personal information across your document estate — what was found, how sensitive it is, where it lives, and the exposure it creates.

Across 1 scan, this assessment analysed 333,097 files and identified 104,327 containing personally identifiable information (31.3% exposure rate), with 244,968 total PII instances detected. Of these, 35,169 critical and 3,629 high-risk files require immediate attention. Date of Birth is the most frequently detected PII type (198,556 instances).

Prepared for

ACME INC : Xplan files

Source

Folder · 309,603 documents

Issued

14 September 2026

Framework

Health Insurance Portability and Accountability Act

PII findings

244,968

Individual findings detected

11 data types

across all sources

By sensitivity

6,996

Restricted items

217,008 confidential

20,964 internal

Identifiability

35,169

Files identifying a person

3,629 identifiable

with extra data

Top PII type

Date of Birth

Most-found data type

198,556 instances

in 67,691 files

Top actions

what to do next

Review the 6,996 restricted-grade findings flagged in this assessment.

Prioritise the highest-sensitivity data — Date of Birth and Centrelink CRN.

Apply retention policies to aged data — 8,104 findings sit in documents over 10 years old.

Verify all PHI access paths map to permitted purposes (treatment, payment, healthcare operations).Privacy-Rule

Obtain patient authorization for any non-permitted use identified in scan findings.Privacy-Rule

Exposure overview

posture · sensitivity · risk matrix

65HIGH

Privacy Posture Score

Elevated exposure

A high share of identifiable records carry restricted-grade PII (TFN, Medicare, passport), concentrated in a small number of documents.

6,996 restricted-grade findings

Sensitivity distribution

Restricted

6,996

Confidential

217,008

Internal

20,964

Public

Risk matrix · sensitivity × category

partial

identified

identifiable

anonymous

Restricted

33,585

Confidential

57,115

1,584

3,629

Internal

8,412

Public

Compliance impact

Health Insurance Portability and Accountability Act · US

307,385 scanned · 2,218 partial · 632 declined · 22,844 excluded · 182 failed

Privacy Rule — permitted uses and disclosures of PHIHigh

Protected Health Information may only be used/disclosed as permitted by the rule or with authorization.

219,296 findings · 79,080 files

PII exposure & priority

every type, ranked by risk × age × volume

#	PII type	Instances	Files	Risk	Priority
1	Tax File Number (TFN)Restricted	1,469	762	10/10	120
2	Bank Account (BSB + Account)Restricted	5,219	616	10/10	120
3	Medicare NumberRestricted	236	69	10/10	119
4	Date of BirthConfidential	198,556	67,691	7/10	102
5	Passport NumberRestricted	68	43	10/10	102
6	Centrelink CRNConfidential	18,362	10,992	7/10	100
7	Credit Card NumberRestricted	4	4	10/10	100
8	Person NameInternal	20,740	11,389	4/10	70
9	Personal Number (passport MRZ)Confidential	3	3	7/10	70
10	Driver's LicenceConfidential	87	75	7/10	70
11	Australian AddressInternal	224	212	4/10	50

Priority = Risk Weight×10 + Retention-Risk %×0.5 + Volume Bonus (100+ items +10, 1K +20, 10K +30). Retention-age bar: current · 7–10 yrs · 10+ yrs. Top-3 and 30%+-overdue rows are tinted.

PII combinations

personal-data categories that co-occur in the same files

i About this data

Each column is a combination of personal-data categories that appear together in the same files; the bar above it shows how many files hold exactly that mix. The dots show which categories are in each combination. The more categories a file combines — and the more sensitive they are (the redder bars) — the easier it is to tie that file back to a specific person, so the tall red columns are your highest re-identification risk.

Showing the 9 most common of 15 category combinations — rare mixes (under 964 files) omitted.

File analysis

file type distribution

File types

PDF DOCUMENT

233,619

WORD DOCUMENT

49,391

OUTLOOK EMAIL

36,970

RTF DOCUMENT

3,065

TIFF IMAGE

2,866

EXCEL SPREADSHEET

2,754

Duplicate files

redundant copies across the estate

42,471

Duplicate files

15,778

Duplicate sets

7,259

Duplicates carrying PII