Use case

Hide Medicare numbers and PHI when screen sharing

6 min read

  • Smart Blur
  • United States
  • HIPAA
  • Screen sharing
  • Screenshots

A billing specialist shares their screen so the software vendor can see why a claim keeps getting rejected. A nurse on a call with an insurer pulls up the chart to answer a question. It’s routine work, and it can put a patient’s Medicare number, medical record number or insurance member ID in front of someone with no reason to see it.

One number is enough under HIPAA

HIPAA’s Privacy Rule protects health information that identifies a patient, and it’s specific about what counts. Its list of identifiers includes medical record numbers, health plan beneficiary numbers, account numbers, Social Security numbers, names, phone numbers, email addresses, dates such as a birth date, and full-face photos. A Medicare number is a health plan beneficiary number. On a records screen it sits next to a name and a date of birth, and together that’s protected health information.

The rule for when it’s seen by the wrong person is spelled out as well. Under the Breach Notification Rule, a use or disclosure the Privacy Rule doesn’t permit is presumed to be a breach, unless the practice or business associate can show through a risk assessment that there’s a low probability the information was compromised. If it can’t, the patient has to be told without unreasonable delay, and no later than 60 days after the breach is discovered.

A vendor’s support engineer reading a patient’s details off your screen won’t make the news. It can still mean a risk assessment, paperwork and possibly a letter to the patient, all because of a twenty-minute support call. And if the call was recorded, those details are now in someone else’s recording.

The Medicare number

Medicare used to identify patients by a number based on their Social Security number. Since January 2020, claims have needed the Medicare Beneficiary Identifier, or MBI, instead. It’s eleven characters, randomly generated, and printed on the card as 1EG4-TE5-MK73. The dashes are only on the card; most systems store and show it as 1EG4TE5MK73.

Because it mixes letters and digits, it doesn’t look like an SSN, a phone number or a card number, and general-purpose blur tools miss it. Smart Blur’s built-in Patterns miss it too.

Setting up Smart Blur for patient records

Smart Blur blurs the page in your browser, before anyone on the call sees it and before you take a screenshot. It works entirely on your computer and needs no account, so the records you’re protecting stay put.

It already blurs emails, phone numbers, card numbers and Social Security numbers. The rest of a patient record needs your own patterns, which are free to add: open the Smart Blur panel and go to Settings → Patterns → Your own patterns.

Medicare Beneficiary Identifier

Choose Write a regex and paste:

\b[1-9][AC-HJKMNP-RT-Y][AC-HJKMNP-RT-Y\d]\d[\s-]?[AC-HJKMNP-RT-Y][AC-HJKMNP-RT-Y\d]\d[\s-]?[AC-HJKMNP-RT-Y]{2}\d{2}\b

It’s long because it follows the MBI’s published rules exactly: a digit from 1 to 9 first, then letters and digits in fixed positions, and never the letters S, L, O, I, B or Z, which Medicare leaves out to make the number easier to read. It catches 1EG4-TE5-MK73 and 1EG4TE5MK73 alike. Untick Match upper and lower case before you add it, so only capitals count.

Medical record numbers and member IDs

Your practice management system sets record numbers, and each insurer sets its own member IDs, so there’s no single format. Most are a fixed prefix followed by a run of digits or letters, which is what Describe it is for. Look at a few real ones and fill in the sentence:

  • A record number like MRN 00482913: starts with MRN, then 8 to 8 digits.
  • A member ID like XYZ123456789: starts with XYZ, then 9 to 9 letters or numbers, with your insurer’s prefix in place of XYZ.
  • Record numbers with no prefix, like 00482913: leave Starts with empty, then 8 to 8 digits. That’s broad, so limit it to your EHR (see below).

Paste some real text into the Try it box, check that only the right numbers are highlighted, and click Add pattern. To keep a rule to your EHR or billing portal, tick Limit to specific domains or URLs and add its address.

Dates of birth

A date of birth looks like any other date, so a pattern for it blurs every date on the page. In an EHR that’s usually acceptable. If yours shows dates as 03/14/1962, add this pattern, limited to the EHR’s address:

\b\d{1,2}/\d{1,2}/\d{4}\b

Names

The patient’s name is often the most identifying thing on the screen. If you know which names will come up, add them under Keywords to hide; it works the same way as hiding client names. Smart Blur Pro’s Local AI finds names and addresses in the text without a list, and runs entirely on your computer.

Before the call

Smart Blur is on by default. Smart Blur Pro’s Share Shield can also switch it on for you the moment you start sharing from your browser.

Open a real record and check that every number is fully blurred. Watch for IDs shown in their own box or column next to a label. A pattern blurs the text it matches, so if your system splits an ID across two fields, test both.

Scanned insurance cards, ID photos and PDF previews are images rather than text, so cover those with Click or Draw from the panel. For screenshots, blur first and capture second; Smart Blur Pro’s Screenshot button does both in one step.

Smart Blur is one safeguard among the ones HIPAA expects. It doesn’t replace your policies, training or minimum-necessary practices.

Patient records often hold a driver’s license number as well, and every state formats those differently: see driver’s license numbers by state. Billing screens add Social Security numbers and bank details.

This post explains the law in general terms and isn’t legal advice. Your privacy officer is the right person to ask how it applies to your organization.

Sources