Medical information, also called Protected Health Information (PHI) is a special class of information that contains details about an individual's health and identity.
PHI is protected by special laws and regulations that specify the requirements for gathering, storing, transmitting, and disclosure of the information. This information is sensitive and requires additional controls for handling. Failure to protect the data in accordance with the regulations can result in penalties for the customer and the provider.
Policies that address the special requirements of PHI protections and evidence that these are being followed may be requested. This may include reviewing data classification guidance, review of any service providers that a SaaS provider may be using, and design or engineering documents showing that the controls have been designed and implemented for PHI.