What Is PHI? Protected Health Information Explained (With Examples)

PHI stands for protected health information. The “protected” part is doing real work: it signals that HIPAA’s Privacy Rule applies, with all the use, disclosure, and safeguard requirements that come with it.

The regulation builds the definition in layers. Health info includes your physical or mental health, the kind of care you received and how much and how you paid for it. Once it was created or received by a provider, health plan, employer, or clearinghouse, it gets individually identifiable. It identifies the person or gives a reasonable basis to believe it could. And it becomes protected once a covered entity or business associate transmits or maintains it, in any form.

A tidy example chain shows the escalation. “A broken leg” is health information. “Mr. Jones has a broken leg” is individually identifiable health information. Once a clinic records it, it's PHI.

A piece of information is PHI when it passes all three of these tests:

1. It’s health-related. This info is somehow related to past, present, or future physical or mental health, the provision of care, or how you choose to pay for it. Demographics collected alongside care count too.
2. It identifies someone. It names the person outright, or contains enough detail to give a reasonable basis to believe they could be identified.
3. A covered entity or business associate handles it. The same fact sitting in your personal diary isn't PHI. In a hospital's records system, it is.

The third test trips people up the most. A name and phone number left for a callback – with no health information attached – isn’t PHI yet; it becomes PHI once added to a treatment record. Likewise, heart-rate data in your fitness app generally isn’t PHI, because no covered entity is involved (FTC rules may apply instead). The same reading in your cardiologist’s chart absolutely is.

Two groups carry the obligation:

1. Covered entities. In this case, the group includes health plans, health care clearinghouses, and health care providers that send and receive health info online in connection with covered transactions. The list includes hospitals, clinics, insurers, and billing clearinghouses.
2. Business associates. People and organizations outside the covered entity’s workforce that handle identifiable health information on its behalf – billing companies, IT and cloud vendors, transcription services, law firms, consultants, document processing providers. Before any PHI changes hands, there must be a written business associate agreement in place.

One guardrail applies to both: the minimum necessary standard – reasonable efforts to use, disclose, or request only the minimum PHI needed for the purpose. It doesn’t apply to treatment disclosures, disclosures to the individual, authorized uses, or uses required by law. For everything else, “send the whole chart” is rarely the right answer.

HIPAA's Safe Harbor method lists 18 identifiers that make health information identifiable:

1. Names
2. Geographic subdivisions smaller than a state – street address, city, county, ZIP code
3. All date elements except year – birth dates, admission and discharge dates – plus ages over 89, which must be grouped as “90 or older”
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and license numbers
12. Vehicle identifiers, including license plates
13. Device identifiers and serial numbers
14. URLs
15. IP addresses
16. Biometric identifiers, including finger and voice prints
17. Full-face photos and comparable images
18. Any other unique identifying number, characteristic, or code

A note on ZIP codes: the first three digits can stay only if the area they cover holds more than 20,000 people; otherwise they're changed to 000.

If your job involves stripping these from records, our guide to producing properly redacted medical records walks through how to find and remove each of the 18 in real documents.

The payment category surprises people. An insurance claim or EOB that never mentions a diagnosis is still PHI if it ties an identifiable person to care they received – which is why insurance document redaction is its own discipline, not an afterthought.

The regulation carves out explicit exclusions:

• Education records covered by FERPA, plus the records described at 20 U.S.C. 1232g(a)(4)(B)(iv)
• Employment records held by a covered entity in its role as an employer – a hospital’s HR file containing an employee's sick note is excluded, even though the hospital is a covered entity
• Records of people deceased more than 50 years

Beyond the formal exclusions, remember the context test. Health data with no covered entity in the chain – fitness trackers, wellness apps, your own notes – generally isn't PHI. And de-identified data, covered below, is no longer PHI at all.

ePHI isn’t a different kind of information – it’s PHI in electronic form, and the Security Rule’s safeguards focus on it. PII is the broader umbrella: most PII (a name on a mailing list, say) has nothing to do with health. We've unpacked that broader category in what counts as PII.

HHS recognizes two methods of de-identification:

1. Safe Harbor. Remove all 18 identifiers – for the individual and their relatives, employers, and household members – and have no actual knowledge that the remaining information could identify anyone. Done properly, the result “is no longer considered protected health information”.
2. Expert Determination. A qualified expert applies statistical or scientific methods, determines the re-identification risk is very small, and documents how.

There’s a middle ground: the limited data set under 45 CFR 164.514(e). It strips direct identifiers – names, phone and fax numbers, email addresses, SSNs – but can keep dates and some location data. It's still PHI, and sharing it requires a data use agreement.

One caution: de-identification means the identifying data is actually gone, not hidden. Techniques differ in what they remove and what they merely obscure – the difference between redaction and data masking matters a great deal here.

HIPAA gives individuals real leverage over their own records. Under 45 CFR 164.524, a covered entity must act on an access request no later than 30 days after receiving it, with one extension of up to 30 days allowed if the entity gives written notice. Patients can also request amendments to their records and an accounting of disclosures – a list of where their PHI has gone.

For records teams, that 30-day clock is usually what turns PHI theory into a production deadline.

Here’s the uncomfortable part. Most document PHI leaks don’t happen because someone forgot to redact – they happen because someone redacted cosmetically. A black rectangle drawn over live text in a PDF hides nothing: the text underneath is still there, selectable and searchable, one copy-paste away from exposure. We've documented what happens when redaction fails that way.

The second blind spot is metadata. A PDF can carry author names, revision history, and embedded content that never appears on the page – which is why removing metadata from a PDF belongs in any release checklist.

A sane workflow for sharing documents that contain PHI looks like this:

=> Identify every instance of the 18 identifiers, not just the obvious names

=> Redact permanently – remove the underlying text and image data, don't cover it

=> Strip metadata and hidden layers before release

=> Verify the output by searching the final file for terms you redacted

Doing this by hand across hundreds of pages is where mistakes creep in. Automated PHI redaction software handles identification and permanent removal in one pass, so the version you release is the version you intended to release.