Healthcare startup here: Yes, because first/last name are PHI identifiers, and it's possible that even using the product itself could be considered a breach bec

Healthcare startup here: Yes, because first/last name are PHI identifiers, and it's possible that even using the product itself could be considered a breach because you don't have control over the data. If the filenames some non-phi unique identifier, you're fine. What's the difference between sending data within in a file, and having the file named something that is an important data point? None. So naming the file with a PHI field (even MRN!) is a bad idea to begin with. A good answer would be to not let true patient data leave the hardened production server and be opened in any kind of development environment, ever.