{"version":"2.1.236","anchor":"telemetry-events-are-scrubbed-against-per-field-allowlists-f","canonical_anchor":"telemetry-events-are-scrubbed-against-per-field-allowlists-f","heading":"Telemetry events are scrubbed against per-field allowlists for HIPAA accounts","tier":"notice","area":"Telemetry","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236\/e\/telemetry-events-are-scrubbed-against-per-field-allowlists-f","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236","markdown":"### Telemetry events are scrubbed against per-field allowlists for HIPAA accounts\n\nOn HIPAA-entitled accounts, unrecognised telemetry fields are replaced with a placeholder before anything is sent.\n\n**What**\n\nOn accounts whose entitlement includes \"hipaa\", a new pass checks every telemetry field against an allowlist before anything is sent and replaces anything unrecognised with a fixed `hipaa_redacted` placeholder.\n\n**Details**\n\n- Recognised shapes are matched by regex for UUIDs, session ids and version strings, and by fixed enumeration for platform, architecture and client type.\n- Any string field not on the list is redacted wholesale rather than passed through.\n- A helper emits a HIPAA notice at most once per terminal.\n- Keyed on the \"hipaa\" entitlement check, so accounts without it are unaffected.\n\n**Evidence**\n\n`hipaa_redacted`\n\n- Area: Telemetry\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 3\/5"}