Hipaa: Pii Leakage

To identify Pii Leakage vulnerabilities that violate Hipaa, organizations must test for specific conditions where sensitive data appears in API responses. middleBrick automatically detects this through its Pii scanning capability that checks response bodies for:

• Pattern matching against 27+ regex signatures for Pii formats (SSN, credit card numbers, medical record numbers)
• Context-aware identification of health-related data fields in JSON responses
• Detection of Pii in error messages, debug endpoints, and verbose logging outputs

During a scan, middleBrick performs:

1. Response body analysis for Pii patterns using the same regex engine used in Hipaa compliance frameworks
2. Contextual correlation of Pii findings with API endpoints handling health data
3. Severity scoring based on the type and quantity of Pii exposed

Example scan output for a Hipaa-violating endpoint:

❌ Pii Leakage Detected - Critical Severity
Endpoint: /api/v1/patients/12345
Finding: Patient record exposed in response
Types of Pii found: SSN, Medical Record Number, Full Name, Diagnosis
Sample exposed data: {
  "patient_id": "123-45-6789",
  "mrn": "MRN-987654",
  "name": "John Doe",
  "diagnosis": "Type 2 Diabetes"
}

middleBrick maps these findings directly to Hipaa's Privacy Rule standards, identifying which specific regulation is violated by the exposure.

Detecting Pii Leakage in API responses requires understanding both the data patterns and the context in which they appear. middleBrick's detection methodology includes several specific techniques:

• Regex Pattern Matching: Scanning response bodies for 27+ Pii patterns including:
• \b\d{3}-\d{2}-\d{4}\b for US Social Security Numbers
• \b[A-Z]{2}\d{6}\b for state medical record identifiers
• \b\d{10}\b for raw medical record numbers
• \b\w+@\w+\.\w+\b for email addresses in error messages
• Contextual Analysis: Identifying Pii exposure based on endpoint purpose and request parameters, such as:
• Endpoints containing '/patient' or '/health' that return full records when queried with minimal parameters
• Debug endpoints that echo request bodies without filtering
• Response Structure Examination: Analyzing JSON structures for fields that commonly contain Pii like 'ssn', 'mrn', 'diagnosis', 'treatment', 'member_id'

Practical detection examples:

// middleBrick scan output example
⚠️ Pii Leakage Warning - Medium Severity
Endpoint: /api/debug/query
Finding: Potential Pii exposure in debug response
Exposed data pattern: Email address detected in response
Sample: "debug_info": {"user_email": "john.doe@hospital.org", "request_body": "..."}

Code-level detection scenarios:

// Vulnerable debug endpoint
app.get('/debug', (req, res) => {
  res.json({
>    status: 'ok',
>    query: req.query,
>    full_request: req.body
>  });
>});

middleBrick identifies this as problematic because it returns the complete request body, which may contain Pii even in simple GET requests. Another example:

// Vulnerable logging that exposes Pii
app.use((req, res, next) => {
>  console.log('Incoming request:');
>  console.log('Body:', JSON.stringify(req.body));
>  next();
>});

middleBrick detects this pattern during scanning and flags it as Pii Leakage risk when the logged content contains sensitive fields.

Remediation of Pii Leakage vulnerabilities requires specific code changes to prevent unauthorized data exposure while maintaining API functionality. middleBrick provides actionable guidance with concrete implementation examples:

• Field Filtering: Modify API responses to exclude Pii fields by default
• Error Message Sanitization: Remove sensitive data from error responses
• Logging Controls: Implement filtering for Pii in debug and audit logs

Practical remediation examples:

// Fixed patient endpoint - only return non-Phi fields
app.get('/patients/:id', (req, res) => {
>  const patient = db.getPatient(req.params.id);
>  // Remove Pii fields before response
>  const safePatient = {
>    id: patient.id,
>    name: patient.name, // Consider if name should be exposed
>    created_at: patient.created_at
>  };
>  res.json(safePatient);
>});

More targeted filtering for Hipaa compliance:

// Selective field inclusion based on authorization
app.get('/patients/:id', (req, res) => {
>  const patient = db.getPatient(req.params.id);
>  
>  // Only authenticated admins can see full records
>  if (req.user.role !== 'admin') {
>    const { ssn, mrn, diagnosis } = patient;
>    res.json({
>      id: patient.id,
>      name_initial: patient.name.split(' ')[0].charAt(0) + '.',
>      created_date: patient.created_at
>    });
>    return;
>  }
>  
>  res.json(patient); // Full record only for admins
>});

Error message sanitization example:

// Fixed error handling - no Pii in responses
app.use((err, req, res, next) => {
>  console.error('API Error:', err); // Log full details server-side
>  
>  // Create sanitized error response
>  const errorResponse = {
>    message: 'An error occurred processing your request',
>    code: 'API_ERROR'
>  };
>  
>  // Only include technical details in specific error types
>  if (err.name === 'ValidationError') {
>    errorResponse.details = `Validation failed: ${err.message}`;
>  }
>  
>  res.status(400).json(errorResponse);
>});

Logging control implementation:

// Secure logging middleware
app.use((req, res, next) => {
>  const safeBody = { ...req.body };
>  
>  // Remove Pii fields from logs
>  ['patient_id', 'ssn', 'mrn', 'diagnosis', 'email'].forEach(field => {
>    delete safeBody[field];
>  });
>  
>  console.log('API Request:', {
>    method: req.method,
>    path: req.path,
>    payload: safeBody
>  });
>  next();
>});

Implementation of field-level filtering using middleware:

// Response filter for Pii removal
const filterPii = (data) => {
>  if (Array.isArray(data)) {
>    return data.map(filterPii);
>  } else if (data !== null && typeof data === 'object') {
>    const filtered = { ...data };
>    
>    // Remove common Pii field names
>    const piiFields = ['ssn', 'mrn', 'patient_id', 'diagnosis', 'treatment', 'member_id'];
>    piiFields.forEach(field => delete filtered[field]);
>    
>    // Recursively filter nested objects
>    Object.keys(filtered).forEach(key => {
>      if (filtered[key] && typeof filtered[key] === 'object') {
>        filtered[key] = filterPii(filtered[key]);
>      }
>    });
>    
>    return filtered;
>  }
>  return data;
>};

// Usage in route
app.get('/data', (req, res) => {
>  const result = db.getSomeData();
>  res.json(filterPii(result));
>});

These remediation patterns directly address Hipaa's requirements for minimum necessary disclosure and prevent Pii Leakage in API responses.