# GRD-006: Detect sensitive health and workforce information


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-010
- URL: /r/GRD-006

**Acceptance criteria:** Recognize sensitive patient, clinical-research and employee information in context, including when users summarize or rewrite it. Document supported prompts and file types.

**Why it matters:** Sensitive records can appear in everyday prose, not just structured forms or obvious identifiers.

**How to verify:** Test synthetic health and workforce examples in prompts and supported files, including summarization requests. Compare results with nonsensitive reference text.

**OWASP adoption context:** Employee records can flow through shadow use, assistants, integrated platforms and citizen workflows, making those the primary workforce-data test contexts.

**Mappings:**
- NIST CSF 2.0: PR.DS-02 — Recognizing named employee medical, accommodation, compensation and performance details supplies a detection input for in-transit protection. Detection alone does not restrict disclosure.
- NIST AI RMF: MEASURE 2.10 — Findings about named employees make privacy exposure and potential impacts on individuals or groups visible for assessment. Recognizing sensitive workforce prose does not itself examine or document the full consequences.
- SOC 2: CC6.7, C1.1 — Workforce-record recognition informs release restrictions and identification of records designated confidential. Permitted use, access and retention remain organizational decisions; this does not establish a privacy program. C1.1 applies only when the Confidentiality category and relevant information are in scope.
- ISO 27001: A.8.12, A.5.34 — Detection of named employee records feeds leakage-control decisions and privacy safeguards. A.8.12 needs an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Monitoring these records itself needs approved privacy handling; detection does not determine employment-law or privacy compliance.