# Health data

URL: /systems/legal-and-corporate/floor/health-data · Id: `floorRow:health-data`

> Health data requires a signed BAA before PHI flows, keeps PHI inside its Tenant, and gates consumer health data behind Consent.

Health data requires a signed BAA before PHI flows, keeps PHI inside its [Tenant](/business/nouns/tenant), and gates consumer health data behind [Consent](/business/nouns/consent).

| Property | Value |
| --- | --- |
| Wakes | A Product handles PHI for a provider, plan, or clearinghouse, or collects health data from consumers. |
| Process | [Screening](/workflows/processes/screening) |
| Signs | [Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal) |
| Sources | HIPAA Privacy, Security and Breach Notification Rules, 45 CFR Parts 160 and 164; False Claims Act, 31 U.S.C. 3729 ff., where a Product bills Medicare or Medicaid; Washington My Health My Data Act, RCW 19.373 |