What Counts as PII? A Plain-English Guide for Regulated SMBs

Ask ten people in a small office what "PII" means and you will get ten answers, most of them stopping at Social Security numbers. Personally identifiable information is broader than that: it is any data that can point to a specific person, either on its own or when combined with other details. Knowing where that line sits is the first step toward protecting it, and it is the step most small regulated offices skip.

Direct and indirect identifiers

Direct identifiers point to a person all by themselves. Think of a Social Security number, an ITIN, a passport number, a driver's license number, or a payment card number. Lose one of these and the person on the other end has a real problem to deal with.

Indirect identifiers are the quieter group: date of birth, ZIP code, gender, employer, job title. None of them names anyone alone, but a few of them together can often narrow a crowd down to one person. A spreadsheet with birth dates and ZIP codes next to a client name is more sensitive than it looks, and a date of birth sitting beside a name is a classic ingredient in identity theft.

Names, phone numbers and email addresses are also personal information, and you should treat them with care. They are common, though, and on their own they carry less risk than a government ID number. That distinction matters when you are deciding what to fix first.

The categories that raise the stakes

• Government IDs: Social Security numbers, ITINs, passports and driver's licenses. They are hard to change and widely accepted as proof of identity.
• Payment card data: the card number is covered by the PCI DSS standard if you store, process or transmit it.
• Health information: diagnoses, treatment notes and insurance details, which many laws treat as especially sensitive.
• Financial account details: bank account and routing numbers, tax returns, loan files.

Different rules attach to different categories. Tax preparers and many accounting firms fall under the FTC Safeguards Rule. Nevada businesses holding residents' information are subject to NRS Chapter 603A, which generally defines personal information as a name plus an SSN, driver's license, account or card number with access code, a medical or health insurance ID number, or a username or email address with the password to an online account. Every state has its own breach notification law, so check the current law for the states where your clients live.

Where PII actually lives

The riskiest PII in a small office is rarely in the practice-management system with the password and the audit log. It is in the places nobody thinks about:

• a scanned intake form still sitting in a Downloads folder;
• last year's organizer spreadsheet on the front-desk PC;
• an emailed attachment saved to a synced OneDrive or Google Drive folder, which now exists on every device signed in to that account;
• a USB disk of old exports in a desk drawer.

Security people call this shadow data. Nobody decided to keep it. It accumulated, and because it is forgotten it is also unprotected.

What to do this week

1. Write down which categories of PII your office handles. Be specific: "SSNs on tax organizers," "dates of birth on client intake forms," "card numbers on invoices."
2. For each category, list where the official copy lives, then ask staff where else copies might be: desktops, downloads, email, synced folders, external disks.
3. Decide which category worries you most and look there first, by hand, for a few files.
4. Run a scan so you are not relying on memory. MyVaultMate looks for Social Security numbers and ITINs, payment card numbers, driver's license, passport and date-of-birth values that sit next to their labels, medical record numbers, Medicare numbers and health insurance member IDs, and a keyword signal that a file reads like a medical record. It reads Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files. It does not read pictures, videos, recordings or scanned PDFs; each one is listed as “Not scanned” with a risk score of 70.

Be realistic about the limits. Detection is rule-based, so occasional false alarms happen, and the health signal says a file looks like a medical record rather than identifying individual people. It flags phone numbers and email addresses as Low findings, but it does not look for names. It also finds and ranks; it does not fix. Moving, encrypting or deleting files is work for you or your IT provider.

The point of the exercise is simple: you cannot protect what you have not listed. For specifics about which rules apply to your office, talk to your attorney or advisor. You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).