A systematic audit of PostHog event properties, autocapture output, SDK configuration, session recording metadata, and tracked URL patterns identified 8 distinct categories of PHI exposure in the live analytics pipeline. Each finding was classified against 45 CFR 164.514(b)(2) Safe Harbor de-identification standards.
Category 1
Clinical Questionnaire Responses
Autocapture was recording element text from clinical form fields, including responses to PHQ-9 depression screening, GAD-7 anxiety assessment, and suicide risk evaluation instruments. The text values of radio button groups and dropdown selections on mental health forms were flowing directly into PostHog event properties.
Found in: autocapture element text on patient-facing clinical forms
Category 2
Patient Demographics
Sex, race, ethnicity, marital status, language preference, insurance relationship, and family relationship data was being captured by autocapture on intake form surfaces. Each of these fields is an enumerated PHI identifier under HIPAA Safe Harbor. The platform had no way to distinguish clinical form surfaces from marketing pages in the autocapture configuration.
Found in: autocapture element text on patient intake forms
Category 3
Medical Record Numbers in URL Parameters
Sequential integer patient record identifiers and encounter IDs were embedded in the URL parameters of tracked pageview and submission events. These were present in every event generated from patient record and clinical workflow pages. Medical record numbers are an explicit HIPAA identifier category under Safe Harbor and cannot be treated as anonymised.
Found in: tracked URL parameters on patient record pages
Category 4
Patient Contact Identifiers in Custom Events
Backend-originated custom events were emitting patient email addresses, phone numbers, and mailing addresses as event property values. Boolean indicators revealing whether SSN, email, phone, or address data had been provided by the patient were also present. The combination of direct identifiers with data-presence flags created a clear PHI exposure path.
Found in: backend custom event properties
Category 5
GeoIP Resolution at Full Fidelity
All events carried PostHog’s default GeoIP enrichment at city, state, postal code, and lat/long resolution. HIPAA Safe Harbor requires geographic data aggregation to the first three digits of ZIP code at minimum. City-level resolution on patient-associated events could identify individuals in sparsely populated areas.
Found in: default GeoIP enrichment on all events
Category 6
Referrer Headers Leaking Source Context
HTTP referrer headers from patient portal access points were being captured in event properties, revealing the specific patient portal URL and inbound path. This created a linkage between the patient’s clinical session and the analytics event stream — information that could associate a specific patient cohort with a specific practice or clinical pathway.
Found in: HTTP referrer header values in event properties
Category 7
Console Errors Containing PHI
Console log capture was active on clinical surfaces. Browser console errors generated during form interactions were being recorded in session replay metadata. These errors sometimes contained patient data values passed in JavaScript stack traces or network error responses. Console logs are typically invisible to most analytics audits.
Found in: session replay console log metadata
Category 8
Anti-Pattern Tracking of Hidden Fields
Several forms had hidden input fields containing patient record context data that were being captured by autocapture alongside visible fields. These fields were not intended for analytics — they were implementation artifacts from form templates. Autocapture does not distinguish hidden from visible fields on the DOM. Hidden PHI fields were being treated the same as visible non-PHI fields.
Found in: autocapture of hidden DOM input fields on forms
