PHI, or protected health information, means any health information that can identify a person and is held or sent by a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA) in any format. The U.S. Department of Health and Human Services (HHS) explains this in the HIPAA Privacy Rule. Some records are specifically excluded by 45 CFR 160.103.
All other information is considered PHI if these three conditions are met:
- A HIPAA covered entity (a health plan, a health care clearinghouse, or certain healthcare providers) or a business associate working for one holds or transmits it.
- It relates to a person’s past, present, or future health, their health care, or payment for that care.
- It identifies the person, or there is a reasonable basis to believe it could.
A date of birth, sex, and five-digit ZIP code together can uniquely identify more than half of US residents, based on research from 2002 and 2006 cited in HHS’s de-identification guidance. These details are not names. Whether information is PHI depends on who holds it, if it relates to health, care, or payment, and if it can identify someone (HHS’s Privacy Rule summary), not just on the presence of a name.
Privacy and compliance teams in healthcare organizations need that question answered. Product teams need it too. It also applies to the data their websites and apps send through tracking technologies.
Key takeaways
- Identifiable health information becomes Protected Health Information (PHI) when a HIPAA-covered entity or business associate holds or transmits it, in any form.
- Who holds the data comes first, and health data outside HIPAA can still fall under other laws.
- Identifiability doesn’t require a name. A reasonable basis to identify someone is enough.
- The 18 identifiers are what Safe Harbor removes, not the definition of PHI.
- De-identified data, FERPA education and student treatment records, employment records held as an employer, and records of people dead for more than 50 years aren’t PHI.
- Covered entities must safeguard PHI in every form, and the Security Rule adds specific safeguards for ePHI.
- On websites and apps, tracking technologies can disclose technical identifiers, such as IP addresses.
What is considered PHI under the HIPAA Privacy Rule?
Under the HIPAA Privacy Rule, first published on December 28, 2000, data is PHI only if it meets three specific checks and is not excluded by name. The order of these checks is important. Failing any check leads to a different outcome: the data may fall outside HIPAA regulations, may not be health information, or may not be identifiable.
Sources: HHS’s summary of the Privacy Rule and the Code of Federal Regulations (45 CFR 160.103 and 164.514).
The decision tree
- Does a HIPAA covered entity or business associate hold or transmit it? If not, it isn’t PHI under HIPAA, though other laws such as the Federal Trade Commission (FTC) Health Breach Notification Rule or state law may still apply.
- Does it relate to a person’s past, present or future health, health care, or payment for care? If not, it isn’t PHI.
- Does it identify the person, or is there a reasonable basis to believe it could? This can include technical identifiers, such as an IP address, a device ID, or another unique code. In American Hospital Association v. Becerra, though, a federal court vacated a portion of HHS guidance. That portion said an IP address combined with a visit to an unauthenticated public page about a health condition or provider triggers HIPAA. If not, or if the data has been de-identified, it isn’t PHI, though it becomes PHI again if a covered entity or business associate re-identifies it.
- If all three answers are yes, it is PHI in any form (electronic, paper, or spoken). The exception is four kinds of records excluded by name in 45 CFR 160.103. They are education records under the Family Educational Rights and Privacy Act (FERPA), student treatment records described in FERPA, employment records held as an employer, and records about people dead for more than 50 years.
The first check is a legal one. Since the HIPAA Privacy Rule only applies to covered entities and their business associates, any health data not held by them is not PHI, no matter what it contains.
For the second check, HIPAA’s definitions in 45 CFR 160.103 cover past, present, or future physical or mental health. They expressly include genetic information.
Identifiability, the third check, reaches beyond a name. Ordinary details, combined, can identify someone, as HHS’s de-identification guidance shows.
Inside a covered entity, certain records form its designated record set (complete guide coming). 45 CFR 164.501 defines it. It covers a provider’s medical and billing records, a health plan’s enrollment, payment, claims adjudication, and case or medical management records, and other records used, in whole or in part, to make decisions about people. Individuals have a right to inspect and get a copy of the PHI about them in a designated record set, with exceptions such as psychotherapy notes. The covered entity must act on a request within 30 days of receiving it and may take one extension of up to 30 more days (45 CFR 164.524).
PHI applies to information in paper or spoken form as well. However, the HIPAA Security Rule’s safeguards only apply to electronic PHI (ePHI).
Which covered entities and business associates must protect PHI?
Covered entities and business associates must protect PHI. HHS’s fact sheet on business associates’ direct liability lists impermissible uses and disclosures of PHI among their violations. The three kinds of covered entities in 45 CFR 160.103 are health plans, health care clearinghouses, and healthcare providers.
- Health plans, including employer-sponsored group health plans, except a self-administered group plan with fewer than 50 participants.
- Health care clearinghouses, such as billing services, that convert health information between nonstandard formats and standard transactions for other entities.
- Healthcare providers that transmit health information electronically in standard transactions, such as claims.
Business associates are not covered entities themselves. They are people or companies that create, receive, maintain, or send PHI for a covered entity, or provide services involving PHI, such as legal or accounting work. Subcontractors also count as business associates if they handle PHI for another business associate.
To disclose PHI to a business associate, or let it handle PHI on its behalf, a covered entity needs satisfactory assurance, documented in a written agreement, that the information will be safeguarded (45 CFR 164.502(e)). HHS’s term is business associate agreement or contract.
A covered entity’s workforce under HIPAA includes employees, volunteers, trainees, and other persons whose work for it is under its direct control. Paid or not, they count as workforce. The entity must train them on its policies and procedures for PHI (45 CFR 164.530(b)).
What are examples of PHI?
Medical records, laboratory reports, and hospital bills are typical PHI when a covered entity or business associate holds them. HHS’s de-identification guidance names those three. Each ties an identifiable person to their health, care, or payment.
- Health: medical records or laboratory reports.
- Care: a record of a health care service, such as a clinic’s record showing that the person was treated there.
- Payment: a hospital bill for healthcare services, or a health plan’s claims records about a member (45 CFR 164.501 places claims records in a health plan’s designated record set).
The same type of information can be PHI or not, depending on who holds it. HHS’s de-identification guidance shows both sides.
| Information | Not PHI when | PHI when |
| A name and phone number | Listed in a public phone book | Listed in a clinic’s records with an indication the person was treated there |
| Information about health plan members | A report that gives only their average age, such as 45 | A medical record, laboratory report or hospital bill about one member |
Is a name, email address, or phone number on its own PHI?
No, not by themselves. According to the PHI definition in 45 CFR 160.103, names, email addresses, and phone numbers are only PHI when a covered entity or business associate holds them in connection with a person’s health, care, or payment. HHS’s de-identification guidance considers a name and phone number listed with care information to be PHI.
What are the 18 HIPAA identifiers?
The Safe Harbor method for de-identification requires removing the 18 HIPAA identifiers, also known as PHI identifiers, for the person, their relatives, employers, and household members. They’re a removal checklist. The test is the PHI definition in 45 CFR 160.103.
45 CFR 160.103 does not list specific identifiers but uses the reasonable-basis test. The list of identifiers comes from 45 CFR 164.514(b)(2).
- Names.
- Geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes. The first three digits of a ZIP code may stay if, by current Census Bureau data, all ZIP codes sharing them together cover more than 20,000 people; otherwise they become 000.
- All elements of dates (except year) directly related to the person, including birth date, admission date, discharge date, and date of death, plus all ages over 89 and any date elements (including year) that indicate such an age. Those ages may be grouped into a single “90 or older” category.
- Telephone numbers.
- Fax numbers.
- Electronic mail addresses.
- Social Security numbers.
- Medical record numbers.
- Health plan beneficiary numbers.
- Account numbers.
- Certificate and license numbers.
- Vehicle identifiers and serial numbers, including license plate numbers.
- Device identifiers and serial numbers.
- Web Universal Resource Locators (URLs).
- Internet Protocol (IP) address numbers.
- Biometric identifiers, including finger and voice prints.
- Full-face photographs and any comparable images.
- Any other unique identifying number, characteristic or code, apart from a re-identification code the rule permits.
What is not considered PHI?
Information that fails a check isn’t PHI. This happens, for example, when no covered entity or business associate holds the data (HHS’s Privacy Rule summary), or when the data has been de-identified (HHS’s de-identification guidance). Four types of records are also excluded by name in 45 CFR 160.103.
| What it is | Why it isn’t PHI | What may still apply |
| Health data no covered entity or business associate holds, as with apps from companies HIPAA doesn’t regulate | Outside HIPAA’s scope (HHS’s Privacy Rule summary) | Federal Trade Commission (FTC) Health Breach Notification Rule and state laws |
| De-identified health information (by either of HIPAA’s two methods in 45 CFR 164.514) | Meets HIPAA’s de-identification standard | HIPAA again, if a covered entity or business associate re-identifies it (HHS’s de-identification guidance) |
| Education records covered by the Family Educational Rights and Privacy Act (FERPA), which, under joint HHS and Department of Education guidance, generally include student health records a school keeps, such as immunization records | Excluded by name in 45 CFR 160.103 | FERPA |
| Student treatment records described in FERPA (the United States Code at 20 U.S.C. 1232g(a)(4)(B)(iv)) | Excluded by name in 45 CFR 160.103 | Not covered here |
| Employment records a covered entity holds as an employer | Excluded by name in 45 CFR 160.103 | Not covered here |
| Records about someone dead more than 50 years | Excluded by name in 45 CFR 160.103 | Not covered here |
A school can be a covered entity. Under joint HHS and Department of Education guidance, it need not apply the Privacy Rule to health information it keeps only in FERPA education records, though a covered school that isn’t subject to FERPA must.
For employers, HHS’s page on employers and health information in the workplace says the Privacy Rule doesn’t protect health details in employment records. An employer’s group health plan is another matter. It can be a covered entity in its own right, and records it holds can be PHI.
Even if HIPAA does not apply, data may still be regulated. Check which US federal and state privacy laws might apply instead.
How does de-identification take data outside HIPAA?
Data stops being PHI when it is de-identified by one of the two methods in 45 CFR 164.514(b), Safe Harbor or Expert Determination. Safe Harbor removes the 18 identifiers. It also requires that the organization have no actual knowledge that what remains could identify someone.
With Expert Determination, a qualified expert evaluates the risk that an anticipated recipient could use the information, alone or with other reasonably available information, to identify the person it is about. This risk must be very small. The expert must document the methods and results.
A limited data set is still PHI. That holds even with direct identifiers like names and street addresses removed (45 CFR 164.514(e)(2)). If a covered entity or business associate re-identifies de-identified information it maintains, HHS’s de-identification guidance says the Privacy Rule protects it again.
Is data from health apps and wearables PHI?
If a covered entity or business associate offers an app, the health information it collects generally is PHI. Information a person enters into an app from a company HIPAA doesn’t regulate falls outside HIPAA. See the guidance on HIPAA and online tracking technologies for more details.
The FTC says makers of health apps, connected devices, and similar products must comply with its Health Breach Notification Rule, which doesn’t cover HIPAA-covered entities or businesses acting solely as their business associates. State law can reach app makers too. California’s Confidentiality of Medical Information Act treats businesses offering apps designed to maintain medical information, for people to manage or for diagnosis or treatment, as health care providers under that act (Civil Code § 56.06).
For wearables, who holds or transmits the data decides whether it’s PHI. The FTC’s own example is a fitness tracker. A company offering one is likely covered by its rule if it sends identifiable health information to health apps (which are likely personal health records) and HIPAA doesn’t already cover it.
Washington has its own law. Its My Health My Data Act covers consumer health data but includes a section exempting PHI (RCW 19.373.100).
How is PHI different from PII?
Unlike PII (personally identifiable information), PHI needs a link to health, care or payment and a covered entity or business associate that holds it (HHS’s Privacy Rule summary). PII is information that can be used to distinguish or trace someone’s identity, alone or combined with other information that is linked or linkable to them, under the Office of Management and Budget’s Circular A-130. That circular applies to federal agencies.
HHS’s de-identification guidance says a name and phone number in a public phone book aren’t PHI. Under A-130’s definition, they would still be PII.
Read complete guide to how PHI and PII differ →
How must covered entities protect PHI under HIPAA rules?
To comply with HIPAA, covered entities must keep appropriate administrative, technical, and physical safeguards in place (45 CFR 164.530(c)). They need to protect PHI in all forms. The HIPAA Security Rule adds extra requirements for electronic PHI, beginning with a risk analysis.
When using or disclosing PHI, covered entities and business associates must also make reasonable efforts to limit it to the minimum necessary (45 CFR 164.502(b)). The minimum necessary standard has exceptions. They include disclosures to a provider for treatment or to the individual.
The Security Rule’s safeguards for electronic PHI (complete guide coming) fall into three groups. Each group includes more safeguards than these.
- Administrative safeguards, such as a required risk analysis and security awareness training for the whole workforce (45 CFR 164.308).
- Physical safeguards, such as workstation-use policies and limiting workstations that access ePHI to authorized users (45 CFR 164.310).
- Technical safeguards, such as unique user IDs and emergency access procedures, both required, and “addressable” automatic logoff and encryption (45 CFR 164.312).
Addressable doesn’t mean optional. The organization must assess whether the safeguard is reasonable and appropriate, implement it if it is, and otherwise document why not and use an equivalent measure where that is reasonable (45 CFR 164.306(d)(3)).
In its guidance on incidental disclosures, HHS gives everyday examples of the reasonable safeguards the Privacy Rule expects. Not all are technical.
- Speaking quietly when discussing a patient’s condition with family in a waiting room or other public area.
- Avoiding patients’ names in public hallways and elevators.
- Isolating or locking file cabinets or records rooms.
- Passwords and other security on computers that hold personal information.
What happens when PHI is breached?
When safeguards fail, any PHI that is acquired, accessed, used, or disclosed in a way not allowed by the Privacy Rule doesn’t permit is presumed to be a breach, apart from three exceptions. A risk assessment can rebut that. It must weigh at least four factors under 45 CFR 164.402 and show there is a low chance the PHI was compromised.
A covered entity must notify affected individuals under 45 CFR 164.404 after a breach of unsecured PHI, without unreasonable delay and no later than 60 calendar days after discovering it, unless a law enforcement official asks for a delay (164.412). Business associates notify the covered entity within 60 calendar days of discovering a breach (164.410). Enforcement of the Privacy and Security Rules sits with HHS’s Office for Civil Rights.
Civil money penalties for HIPAA violations come in four tiers of culpability, with amounts that 45 CFR 160.404 says are updated annually for inflation.
Criminal penalties are separate. A person, including an employee, who knowingly obtains or discloses individually identifiable health information in violation of HIPAA can be fined up to $50,000 and imprisoned for up to one year (42 U.S.C. 1320d-6). The maximums rise to $100,000 and five years under false pretenses, and to $250,000 and ten years with intent to sell or use the information for commercial advantage, personal gain, or malicious harm. State attorneys general can sue too. They act on behalf of their residents (HHS’s page on state attorneys general).
See how to decide whether an incident is a reportable breach and why hospitals still face lawsuits over patient data.
Is the data your website or app sends PHI?
Under HHS’s online tracking guidance, data a covered entity or business associate collects through its website or app is PHI when it identifies a person and relates to their health, care, or payment. HHS singles out logged-in pages. Tracking technologies there, such as on patient portals, generally have access to PHI.
In its general discussion of tracking technologies, HHS says the information disclosed might include medical record numbers and appointment dates as well as technical identifiers such as IP addresses and device IDs. Part of HHS’s tracking guidance no longer stands. A federal court vacated it in American Hospital Association v. Becerra on 20 June 2024.
The vacated part of the guidance stated that HIPAA obligations are triggered when an online technology connects an IP address to a visit to an unauthenticated public page about specific health conditions or health care providers. HHS’s guidance page now flags the ruling. Our guide on when website and app tracking data becomes PHI explains what this means for tracking.
In a footnote, the court clarified that the vacatur does not affect the legal status of other guidance in the same HHS document. HHS’s guidance page, last reviewed on June 26, 2024, says HHS is evaluating its next steps.
At MELURNA, we map website and app traffic from outside. Our results show which identifiers leave a site or app and where they go. MELURNA identifies patient and health-related signals moving through forms, apps, analytics, and embedded services, and compares contracted providers with the recipients observed across appointment, intake, portal, and care journeys. It doesn’t need access to internal clinical systems.
Map where patient data travels from your site and apps →
Next steps
- When website and app tracking data becomes PHI
- How to decide whether an incident is a reportable breach
- HIPAA tracking audit checklist
DISCLAIMER: This article is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.
