[Health IA intake:] PII/PHI removal from title tags in Meds and Medical Records details pages

[sterkenburgsara]

Overview

Potential PHI/PII risks have been identified in some IA components (namely, title tags) in the SM, Meds, and MR details pages within GA4 properties and we need to adjust these components to no longer feed potential risks into analytics.

SM pushed a fix into prod on Friday 8/16/2024, and we will now need to implement similar fixes to title tags in details pages for Meds and MR in this ticket.

Team

• Requester: OCTO / Robyn Singleton
• Team Name: Medications, Medical Records

Description

What details are necessary for understanding the specific work or request tracked by this issue?

Links

• MURAL
• Robyn's documentation in sensitive repo
• My HealtheVet PHI/PII audit report

Work needed

• Need to have new pattern title tags that (in theory) can scale to work for details pages within products across the auth experience.
• Work with a11y + run by content to ensure we are meeting standards as well as we can, while prioritizing avoiding PII/PHI leaks above all else.

Timeline

When does IA review need to be completed by?

Acceptance Criteria

• [x] A new pattern for IA elements that pass PII/PHI vulnerabilities from details pages in Meds & MR has been drafted and approved by health SMEs in a11y, content, IA
• [x] Patterns meet requirements for PHI/PII avoidance
• [x] New title tags have been included in IA specs for these products (so that they will not get flagged as a departure from standards at staging review).
• [x] Recommendation has been shared with Meds & MR teams for ticketing and implementation.

[sterkenburgsara]

Medical Records:

• Confirmed in staging that URLs do not pass any vulnerable information, only randomized ID numbers for details pages under each domain. However, specific medical information does get passed in the title tags for 5/6 domains within Medical Records. Vitals does not pose a risk. However, for the purposes of patterning exceptions, should we update this title tag anyway so that they are all uniform for new standards creation? Will ask Mikki in 1:1 this week.

[sterkenburgsara]

Medications:

• Confirmed that URLs do not pose risks. However, title tags do & will need to be remedied.

Meeting with a11y, content, IA on 8/20/24 to discuss fixes for MR & Meds title tags

[sterkenburgsara]

Team identified a number of a11y & research problems if we move forward with fixes to these title tags. Also, we are unable to pattern a single solution that will scale to all My HealtheVet applications' details pages equally well. Ran into a lot of complexity immediately and moved to reporting known, possible, and unknown issues in the related discovery ticket here instead.

Will await PO & analytics responses to that report before continuing on title tag work.

[johnny-jesensky-adhoc]

Hi @sterkenburgsara, can you keep us in the loop on when the team is able to implement this title tag fix? We can help validate that the fix is going through within Google Analytics.

Let us know if you need any additional information from us on this.

FYI @jestutt

[sterkenburgsara]

@johnny-jesensky-adhoc I was not asked to take on this work yet - awaiting decisions from OCTO POs before doing this work, but if it is prioritized then I will absolutely keep you in the loop!

[sterkenburgsara]

Update: new title tags decided for Medications team on Friday 8/30/2024, and will be implemented by Wednesday 9/5/2024. Medical records replacement title tags determined on 9/04/2024 and those updates have been ticketed for devs to implement.