About this role
Why this is urgent
- DLP is enabled today, but it is not effective in its current state.
- It does not detect the full 18 PHI identifiers.
- It uses the default Defender rule and is generating alerts even when no PHI is present.
- Blocking is a longer-term goal, but we would also need staffing to respond to blocking events.
Requested scope
- Tune DLP to reduce false positives.
- Build an exact data match dictionary.
- Improve detection accuracy and browser exfiltration coverage, including copy/paste.
- Longer term, move to the HIPAA DLP engine, log on every match instead of after five matches, and prepare for blocking when staffing is in place.