We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls.
They are claiming any patient identifier becomes PHI once exposed outside of the system. I'm arguing that in order to map this identifier into PHI, you either need access to the data store or you need to have a valid log in to the system and access controls are in place.
For parties not having access to the data store and not having a valid login, the retrieval of PHI is not possible (barring a security breach).
Does anyone have experience with this? Are internally used identifiers considered PHI under HIPAA? Can anyone point me to the appropriate section in the law?