Frame as STAR, but the credibility is in the mechanisms you name.

Situation. Example: “I built a diabetes care-management dashboard that pulled A1C lab values and medication fills from our claims/EHR warehouse for ~50,000 members.”

Task. What scope of PHI — direct identifiers, clinical data, combined.

Action — the specific controls (name them all):

Minimum necessary. Pulled only the fields needed for the dashboard: member_id, age, most recent A1C, days since last visit. Not name, address, SSN, or full medical history. Documented the minimum-necessary rationale.
Role-based access. Warehouse access was RBAC-controlled; my role had access to PHI under a signed BAA; my query workbook was in a HIPAA-zone workspace, not my laptop.
De-identification where possible. For the dashboard shown to non-clinical leadership, I aggregated to the panel level (clinic, practice) — member-level PHI never left the clinical-team view. When sharing sample data externally, used Safe Harbor de-identification (stripping all 18 HIPAA identifiers).
Audit trail. All queries logged; any export of row-level data required a ticketed request with approval, retained for audit.
Transport and storage. TLS to the warehouse; no copies on local disk; screen-sharing with members’ charts on-screen is a violation in some interpretations — protocol-bound.
Breach response training. Knew who to call if I suspected an exposure: the Privacy Officer, not IT or my manager.

Result. End with a number that isn't just a data result — “the dashboard improved gap closure by 18% quarter-over-quarter, and passed HIPAA audit with zero findings related to my workflow.”

What a weak answer leaves out:

Specific controls — only saying “I was careful.”
BAA / RBAC vocabulary.
The Privacy Officer escalation path.
The distinction between identified, de-identified, and Limited Data Set.
Acknowledgment that even aggregated data can re-identify in small cells (HIPAA cell-size suppression — usually n≥11 for public reports).

Describe how you’ve handled PHI in a project.

Draft your STAR answer

Stuck? Peek at a hint

More healthcare questions