A Complete Guide to Understanding PHI

Protected health information (PHI) is health information that identifies a person and is held by a HIPAA covered entity or business associate. That covers creating, receiving, keeping, or sending it. It includes medical, billing, and insurance records, whether electronic, paper, or spoken. Any one of HIPAA's 18 identifiers linked to health data can make it PHI.

Protected health information (PHI) is the core concept at the heart of HIPAA. The Privacy Rule limits how PHI may be used and disclosed, and the Security Rule protects PHI in electronic form. Yet many healthcare organizations and their business associates struggle to consistently identify what qualifies as PHI, where it resides in their operations, and how to handle it properly. Misunderstanding PHI leads to accidental exposures, compliance gaps, and costly enforcement actions.

This guide explains what PHI is, lists the 18 HIPAA identifiers that make health information identifiable, distinguishes between ePHI and paper PHI, covers de-identification methods, and gives real-world examples that make these concepts concrete. Whether you are new to HIPAA or need a clear reference for your compliance team, this article delivers the practical knowledge you need.

What Is Protected Health Information?

The Three-Part Definition

Under HIPAA, protected health information is any information that meets all three of these criteria:

1. It relates to health: The information concerns a person’s past, present, or future physical or mental health condition, the healthcare given to the person, or the past, present, or future payment for healthcare.
2. It identifies the person: The information identifies the person or provides a reasonable basis to believe the person can be identified.
3. It is held or transmitted by a covered entity or business associate: The information is created, received, kept, or transmitted by an organization subject to HIPAA. A covered entity is a health plan, a healthcare clearinghouse (a company that processes billing data for others), or a healthcare provider. A provider counts if it sends standard transactions, like insurance claims, electronically (45 CFR 160.103). A business associate is an outside company or person that handles PHI while doing work for a covered entity.

All three criteria must be present. Health information that cannot be linked to a person is not PHI. Information that identifies a person but has nothing to do with health is not PHI. And personally identifiable health information held by an organization not covered by HIPAA (such as a fitness app company that is not a covered entity or business associate) does not fall under HIPAA’s PHI definition, though other privacy laws may apply.

What PHI Includes

PHI encompasses a broad range of data that many organizations underestimate:

• Medical records: Diagnoses, treatment plans, test results, clinical notes, imaging reports.
• Billing and payment information: Claims data, explanation of benefits, payment histories, account balances.
• Insurance information: Health plan enrollment records, eligibility decisions, beneficiary identifiers.
• Communication records: Appointment reminders, prescription notices, referral letters, patient correspondence.
• Demographic data linked to health: Name, address, date of birth, and Social Security number when linked with healthcare services.
• Photographs and recordings: Images, video, or audio that identify a patient in a healthcare context.

PHI can be in any form or medium: electronic, paper, or oral. A conversation between two nurses about a patient’s diagnosis in a hospital hallway involves PHI just as much as an electronic health record entry.

The 18 HIPAA Identifiers

Complete List

The HIPAA Privacy Rule specifies 18 types of identifiers that, when linked with health information, make that information identifiable, and therefore protected. These 18 identifiers are central to the Safe Harbor de-identification method:

1. Names: Full name, last name, first name, or initials.
2. Geographic data: Any area smaller than a state, such as street address, city, county, precinct, ZIP code, and their equivalent geocodes. The first three digits of a ZIP code may stay only if the area formed by all ZIP codes with those three digits contains more than 20,000 people.
3. Dates: All parts of a date except the year, for dates directly related to a person (birth date, admission date, discharge date, death date), and all ages over 89.
4. Phone numbers: All telephone numbers.
5. Fax numbers: All fax numbers.
6. Email addresses: All email addresses.
7. Social Security numbers: Full or partial SSN.
8. Medical record numbers: Identifiers assigned by healthcare providers.
9. Health plan beneficiary numbers: Insurance ID numbers.
10. Account numbers: Financial account numbers linked with healthcare.
11. Certificate/license numbers: Professional or other certificate and license numbers.
12. Vehicle identifiers: Vehicle identifiers and serial numbers, including license plate numbers.
13. Device identifiers: Serial numbers of medical devices or other devices linked to the person.
14. Web URLs: Personal web addresses.
15. IP addresses: Internet Protocol (IP) address numbers.
16. Biometric identifiers: Fingerprints, voiceprints, retinal scans.
17. Full-face photographs: Full-face photographic images and comparable images.
18. Any other unique identifying number, characteristic, or code: Catch-all for identifiers not listed above.

Why These 18 Matter

These identifiers are the building blocks of personal identity. Even one identifier, when combined with health information, creates PHI. Organizations must understand that the presence of any single identifier with health data triggers HIPAA protections. A spreadsheet containing diagnosis codes is not PHI, but adding a column with patient names, medical record numbers, or dates of birth right away transforms it into PHI subject to full HIPAA compliance rules.

ePHI vs. Paper PHI

Electronic Protected Health Information (ePHI)

ePHI is PHI that is created, received, kept, or transmitted in digital form. The HIPAA Security Rule applies only to ePHI. It requires administrative, physical, and technical safeguards to protect it, meaning policies, physical security, and technology controls.

ePHI exists in many forms beyond traditional databases:

• EHR systems: The most obvious storage of ePHI.
• Email: Messages containing patient information.
• Text messages: SMS and messaging app communications about patients.
• Cloud storage: Files stored in cloud platforms.
• Portable media: USB drives, external hard drives, CDs, DVDs.
• Mobile devices: Smartphones, tablets, and laptops containing patient data.
• Medical devices: Equipment that stores or transmits patient data.
• Backup tapes and disks: Copies of systems containing ePHI.
• Fax server logs: Electronic records of faxed PHI.
• Voicemail systems: Digital recordings containing patient information.

Paper PHI

Paper PHI includes printed medical records, handwritten notes, prescription pads, printed lab results, faxes, insurance forms, and any other physical record containing identifiable health information. The Security Rule does not apply to paper records; the Privacy Rule does. It requires a covered entity to have "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information" (45 CFR 164.530(c)). Common physical measures for paper PHI include:

• Secure storage: Locked file cabinets and restricted access areas for records.
• Controlled access: Limiting who can access paper records based on job function.
• Proper disposal: Shredding or other destruction methods that render records unreadable.
• Transport security: Protecting paper PHI during transport between locations.

Oral PHI

PHI communicated verbally is also protected under the Privacy Rule. While HIPAA does not require soundproofing every room, a covered entity must reasonably safeguard PHI to limit incidental uses and disclosures (45 CFR 164.530(c)(2)(ii)), including during oral communications. Practical measures include holding sensitive conversations in private areas, avoiding patient discussions in public spaces, and using sign-in sheets that do not expose the reason for a patient’s visit.

De-identification Methods

For the complete technical requirements, see our HIPAA de-identification requirements guide.

Safe Harbor Method

The Safe Harbor method provides a straightforward path to de-identification. Remove all 18 identifiers listed above, for the individual and for relatives, employers, or household members, and the covered entity must have no actual knowledge that the remaining information could be used, alone or in combination with other information, to identify an individual who is a subject of the information. Once properly de-identified under Safe Harbor, the data is no longer PHI and is not subject to HIPAA rules.

Organizations frequently use Safe Harbor de-identification for:

• Research datasets: Providing health data for studies without exposing patient identity.
• Analytics and reporting: Generating operational insights from patient data.
• Training and testing: Using realistic data for system testing and team training.
• Public reporting: Sharing aggregate health statistics.

The challenge with Safe Harbor is that removing all 18 identifiers can greatly reduce the utility of the data. Dates, geographic data, and age information are often key for research and analytics. Organizations must balance data utility with privacy protection.

Expert Determination Method

The Expert Determination method offers more flexibility. A qualified statistical expert applies statistical and scientific principles to determine that the risk of identifying any person from the dataset is “very small.” The expert must record the methods and results of the analysis.

This method allows retention of certain identifiers (such as partial dates or broader geographic regions) when the expert concludes that the combination of remaining data elements does not create a meaningful risk that someone could figure out who the data is about. Expert Determination is more complex and costly than Safe Harbor but produces de-identified datasets that retain greater analytical value.

Limited Data Sets

A limited data set falls between full PHI and fully de-identified data. A limited data set removes direct identifiers (names, addresses, Social Security numbers, etc.) but may retain certain indirect identifiers such as dates, town or city, state, and ZIP code. Limited data sets may be used only for research, public health, or health care operations, and only under a data use agreement that restricts how the recipient may use and disclose the information.

Limited data sets are still subject to some HIPAA protections, unlike fully de-identified data. Organizations considering this approach should understand the specific data use agreement rules and allowed uses.

The Minimum Necessary Standard

How It Applies to PHI

The minimum necessary standard requires covered entities and business associates to make reasonable efforts to limit PHI uses, disclosures, and requests to the minimum necessary to accomplish the intended purpose (45 CFR 164.502(b)). This principle shapes how organizations design access controls, respond to information requests, and structure their data sharing practices.

Applying the minimum necessary standard requires organizations to:

• Define role-based access: Determine what PHI categories each team role needs and restrict access as needed.
• Limit routine disclosures: Create standard procedures for common sharing scenarios that specify the minimum PHI to release.
• Evaluate non-routine requests: Review requests that fall outside standard procedures on a case-by-case basis.
• Restrict internal access: Ensure that team members can access only the PHI needed for their specific job function.

Exceptions to Minimum Necessary

The minimum necessary standard does not apply to:

• Disclosures to or requests by a health care provider for treatment.
• Uses or disclosures made to the individual who is the subject of the PHI.
• Uses or disclosures made pursuant to a valid authorization.
• Disclosures to HHS for compliance enforcement.
• Uses or disclosures required by law.
• Uses or disclosures required for compliance with the HIPAA Administrative Simplification rules (45 CFR Parts 160, 162, and 164).

Treatment is the biggest exception. Healthcare providers need complete patient information to deliver safe, effective care, and the Privacy Rule recognizes that limiting treatment access could compromise patient outcomes.

Real-World PHI Examples

What IS PHI

Understanding PHI becomes clearer with concrete examples:

• A patient’s name on a lab result: Name (identifier) + health information = PHI.
• An insurance claim with a diagnosis code and member ID: Health plan beneficiary number + health information = PHI.
• An email from a doctor to a specialist containing a patient’s medical history and date of birth: Name, date of birth + health information = PHI.
• A photograph of a patient’s wound with their face visible: Full-face photograph + health information = PHI.
• A billing statement sent to a patient’s home address: Name, address + payment information for healthcare = PHI.
• A voicemail from a pharmacy confirming a prescription with the patient’s name: Name + prescription information = PHI.

What Is NOT PHI

Equally important is understanding what does not qualify as PHI:

• Aggregate hospital statistics: “500 patients treated for influenza in January” without personal identifiers is not PHI.
• De-identified data: Health information with all 18 identifiers properly removed is no longer PHI.
• Employment records: Health information in employment records held by a covered entity in its capacity as an employer is not PHI (though other laws may apply).
• Education records: Health information in education records covered by FERPA is excluded from HIPAA.
• Health data from non-covered entities: Information from fitness trackers, health apps, or other sources not connected to a covered entity or business associate is usually not HIPAA-regulated PHI.

Common PHI Mistakes

Organizations frequently stumble in these areas:

• Scheduling boards: Whiteboards in common areas showing patient names and procedures.
• Unencrypted email: Sending PHI via standard email without encryption.
• Social media: Staff posting about patient cases, even without names, when details could identify the person.
• Disposal failures: Throwing paper records in regular trash or donating computers without wiping drives.
• Verbal disclosures: Discussing patient cases in elevators, cafeterias, or other public areas where they can be overheard.

Each of these scenarios represents a possible HIPAA breach. Organizations should address them through clear policies, regular training, and monitoring. A complete HIPAA risk analysis will identify these weak spots in your specific setting.

PHI FAQ

Is a patient’s name alone considered PHI?

A patient’s name by itself is not PHI. It becomes PHI when it is linked with health information (such as a diagnosis, treatment record, or payment for healthcare services) and is held by a covered entity or business associate. A name on a general mailing list, for example, is not PHI unless it is linked to health-related data.

Does PHI include information about deceased people?

Yes. PHI protections apply to deceased people for 50 years following the date of death. Covered entities must protect the health information of deceased patients with the same protections applied to living patients during this period.

Is a medical record number considered PHI even without other information?

A medical record number is one of the 18 HIPAA identifiers. When it appears in a healthcare context (which it inherently does, since it is assigned by a healthcare provider), it can be used to identify a person and link them to health information. Medical record numbers should always be treated as PHI.

What is the difference between PHI and PII?

PHI (protected health information) is health-related information that identifies a person and is held by a HIPAA-covered entity or business associate. PII (Personally Identifiable Information) is a broader concept used in other privacy frameworks that refers to any information that can identify a person, whether or not it relates to health. All PHI contains PII elements. However, not all PII is PHI. For more on HIPAA’s scope, see our What is HIPAA article.

Can PHI be shared for marketing purposes?

PHI may be used or disclosed for marketing only with the individual’s written authorization, with limited exceptions. No authorization is needed for a face-to-face marketing communication or a promotional gift of nominal value. If the marketing involves financial remuneration from a third party to the covered entity, the authorization must state that such remuneration is involved. The Privacy Rule contains detailed rules for marketing-related uses of PHI.

PHI Guide Takeaways

PHI is the foundation of the HIPAA Privacy, Security, and Breach Notification Rules. Organizations that clearly understand what PHI is, where it exists in their operations, and how to handle it properly build compliance programs on solid ground. Those that rely on vague assumptions about PHI inevitably create gaps that lead to breaches, enforcement actions, and erosion of patient trust.

From the 18 identifiers that define identifiability to the practical differences between ePHI and paper records, from de-identification methods to the minimum necessary standard, every concept in this guide translates directly into compliance decisions your practice makes every day. Make those decisions informed ones.

One Guy Consulting offers a compliance portal with policy and procedure templates. The Full-Scope plan adds 4 hours a month of 1:1 implementation calls with Chuck. Our HIPAA compliance guide places PHI protection in the context of a complete compliance program. Contact us if you want help building PHI handling into your practice.

The 18 HIPAA Identifiers

HIPAA defines 18 specific identifiers that make health information individually identifiable. Any health data linked to one or more of these identifiers is PHI.

Sources

• 45 CFR 160.103: Definitions (PHI, Covered Entity, Business Associate).
• 45 CFR 164.514: Other Requirements (De-Identification of PHI).
• HHS: De-Identification Guidance.
• 45 CFR 164.502: Uses and Disclosures General Rules.

Related Reading

• Notice of Privacy Practices Guide.
• HIPAA Authorization Form Requirements.
• HIPAA Minimum Necessary Rule.
• Patient Rights Under HIPAA.

Related reading: HIPAA vs FERPA: Who Covers the School Nurse and the Campus Clinic