What is PHI?
Protected Health Information (PHI) is individually identifiable health information
held or transmitted by a HIPAA covered entity or business associate in any form or medium.
If you're new to HIPAA, start with our
What Is HIPAA? guide
to understand who HIPAA applies to and what information it protects.
PHI generally relates to:
- An individual’s past, present, or future physical or mental health or condition
- The provision of healthcare to an individual
- Payment for the provision of healthcare
- Information that identifies an individual or could reasonably be used to identify them
Common examples of PHI
- Patient names connected to treatment or diagnosis
- Dates of birth linked to medical records
- Email or text messages discussing patient care
- Phone numbers connected to appointment history
- Billing records tied to an individual
- Medical record numbers
- Health insurance member IDs
- Lab results connected to a patient
- Telehealth session recordings containing identifiable health information
- IP addresses linked to identifiable patient information
- Photos showing an identifiable patient
- Biometric identifiers such as fingerprints or voiceprints
- Device identifiers linked to identifiable health information
The HIPAA Safe Harbor identifiers
Under the HIPAA Safe Harbor method for de-identification, specified identifiers
of the individual and certain related persons must be removed.
These categories include:
- Names
- Geographic information smaller than a state, subject to limited ZIP-code exceptions
- Dates directly related to an individual, except year in specified circumstances
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- URLs
- IP addresses
- Biometric identifiers
- Full-face photographs and comparable images
- Other unique identifying numbers, characteristics, or codes
What is not PHI?
- Health information that has been properly de-identified under HIPAA
- General health education that does not contain individually identifiable health information
- Practice-level statistics that cannot reasonably identify individuals
- Aggregated information that does not contain individually identifiable health information
HIPAA provides two recognized methods for de-identification:
Expert Determination and Safe Harbor.
Properly de-identified information is no longer considered PHI under the HIPAA Privacy Rule.
What is a limited data set?
A limited data set is still PHI under HIPAA, but certain direct identifiers are removed.
A limited data set may be used or disclosed for:
- Research
- Public health activities
- Healthcare operations
A covered entity generally must enter into a data use agreement
with the recipient before using or disclosing a limited data set for these purposes.
Common PHI handling issues for solo providers
- Using personal email or cloud storage without reviewing how PHI is protected
- Using messaging tools without reviewing applicable HIPAA safeguards
- Sharing screenshots that still contain identifiable health information
- Overlooking vendor or contractor access to PHI
- Storing intake forms on unmanaged personal devices
- Recording telehealth sessions without appropriate safeguards
Why reviewing PHI flows matters
Solo healthcare providers can benefit from identifying where PHI exists,
how it moves through daily workflows,
and which vendors, systems, or devices may create, receive, maintain, or transmit it.
Understanding these information flows can help identify potential compliance gaps
and areas that may require further review.
Use the
HIPAA Compliance Assessment
to review key HIPAA requirements and identify potential gaps in your current practices.
Prefer a printable overview?
See HIPAA checklist PDF →
Ready to review your HIPAA practices?
Start Free HIPAA Compliance Assessment