What is PHI? Protected health information explained (2026)
PHI, or protected health information, means any health information that can identify a person and is held or sent by a covered entity or business associate under the […]
Read the evidence
Broadcast, Not Stolen: How Passwords and Customer Records Reach Third Parties by Default
Passwords and personal data don’t have to be stolen to end up somewhere they shouldn’t. When an application writes them into a URL or a page title, ordinary analytics, monitoring, and fraud tools collect them by default. A Klaviyo sign-up form with no method attribute sent our test password to 31 third-party hostnames – the same omission we measured on 7,874 websites with credential- or PII-bearing forms across the top 100,000 websites