What Is PHI? Definition, Examples, & HIPAA

Healthcare organizations handle large amounts of sensitive data every day, from medical records and laboratory results to insurance claims and patient communications. Understanding protected health information (PHI) is essential for maintaining patient privacy, meeting HIPAA requirements, and reducing cybersecurity and compliance risks.

So, what is protected health information?

What Is Protected Health Information (PHI)?

Under HIPAA, protected health information (PHI) is any individually identifiable information about a person’s health, healthcare, or payment for healthcare, whether past, present, or future, that is created, received, maintained, or transmitted by a covered entity or business associate.

PHI can include a wide range of information, including medical histories, diagnoses, treatment plans, test results, insurance information, billing records, and communications between patients and healthcare providers. Importantly, health information alone is not automatically considered PHI. The information must identify an individual or provide a reasonable basis to identify that individual.

Protected health information may exist in multiple forms. It can be stored in paper medical records, electronic health records, insurance claim systems, patient portals, email communications, recorded conversations, or verbal discussions between healthcare professionals. The format does not determine whether information is PHI; the content and context do.

Covered entities, such as healthcare providers, health plans, and healthcare clearinghouses, regularly handle protected health information. Business associates that create, receive, maintain, or transmit PHI on behalf of covered entities also have responsibilities related to protecting that information.

Understanding protected health information is fundamental to healthcare privacy, security, and compliance. Whether information exists in paper records, verbal communications, or electronic protected health information (ePHI) systems, organizations must take appropriate steps to protect sensitive patient data and reduce the risk of unauthorized access, disclosure, or misuse.

What Are Examples of Protected Health Information (PHI)?

Understanding what qualifies as protected health information is often easier when looking at practical examples. In general, PHI exists when health-related information can be linked to an identifiable individual and is handled within a HIPAA-regulated context.

For example, a patient’s name connected to a diagnosis, treatment plan, laboratory result, or prescription may qualify as protected health information because it links healthcare information to a specific individual.

Likewise, insurance claims, medical record numbers, billing records, and patient portal communications may be considered PHI when they relate to an identifiable patient.

Common examples of protected health information include:

• Medical records and clinical documentation
• Diagnoses and treatment plans
• Laboratory and imaging results
• Prescription and medication information
• Health insurance and billing records
• Patient portal communications
• Medical record numbers linked to healthcare information
• Healthcare appointment details associated with a patient
• Identifiable photographs connected to healthcare records

Real-world examples of PHI include:

• A hospital discharge summary containing a patient’s name and diagnosis
• A laboratory report connecting test results to a patient’s medical record number
• An insurance claim containing patient information and details about medical treatment
• A prescription record identifying a patient and their prescribed medication
• An appointment reminder that connects an identifiable individual to a healthcare provider or service

Not every piece of information containing a patient’s name is automatically PHI. A name by itself may not qualify as protected health information. However, when it is associated with healthcare, treatment, payment, or another health-related context, it may become PHI under HIPAA.

What Are the 18 HIPAA Identifiers?

The HIPAA Safe Harbor method identifies 18 categories of identifiers that generally must be removed before information can be considered de-identified.

These identifiers include:

1. Names
2. Geographic details smaller than a state
3. Dates directly related to an individual (subject to specific exceptions)
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers, including fingerprints and voiceprints
17. Full-face photographs and comparable images
18. Other unique identifying numbers, characteristics, or codes

These identifiers are important because they can contribute to identifying an individual. However, they should not be viewed as a standalone checklist for determining whether information is PHI. HIPAA also recognizes an Expert Determination method for de-identification, and context remains an important part of the analysis.

What Is Not Considered PHI?

One of the most common misconceptions is that all health-related information automatically qualifies as protected health information. In reality, HIPAA contains several important exclusions.

Properly de-identified information generally is not considered PHI because it can no longer be used to identify a specific individual. Once data has been de-identified in accordance with HIPAA requirements, it no longer receives the same protection as identifiable patient information.

Employment records maintained by a healthcare organization in its role as an employer are also generally excluded from HIPAA’s definition of protected health information. Information related to employee leave, workplace injuries, or employment benefits may not be PHI when maintained as employment records.

Certain education records protected under FERPA may also fall outside HIPAA’s definition of PHI.

These distinctions highlight an important principle: healthcare information alone is not necessarily protected health information. The individual’s identifiability, the information itself, the organization handling it, and the context in which it is used all matter.

What Is the Difference Between PHI, PII, and ePHI?

PHI, PII, and ePHI are related concepts, but they have different meanings and legal implications.

Protected health information (PHI)

Refers specifically to individually identifiable health information protected under HIPAA when handled in applicable contexts.

Personally identifiable information (PII)

Is a broader term used in privacy and security programs to describe information that can identify an individual. Depending on the law or framework, PII may include names, addresses, Social Security numbers, financial information, and other identifiers.

Electronic protected health information (ePHI)

Is PHI that is created, received, maintained, stored, or transmitted electronically.

Examples of electronic protected health information include electronic health records, healthcare applications, patient portals, cloud-based medical systems, digital medical images, and electronic billing records.

A patient’s name stored in a customer contact directory may be considered PII. However, if that same name is connected to a diagnosis, prescription, or treatment record maintained by a healthcare provider, it may qualify as protected health information. When stored electronically, it becomes electronic protected health information.

As healthcare organizations continue adopting digital technologies, protecting electronic protected health information has become a major focus of compliance, privacy, and cybersecurity programs.

What Is Electronic Protected Health Information (ePHI)?

Electronic protected health information is protected health information that is created, received, maintained, or transmitted electronically by covered entities and business associates in applicable HIPAA-regulated contexts.

Unlike PHI stored in paper records or communicated verbally, ePHI exists in electronic formats and is subject to the HIPAA Security Rule.

Common examples of electronic protected health information include:

• Electronic health records (EHRs)
• Digital medical and imaging records
• Electronic laboratory results
• Patient portal information
• Electronic insurance claims and billing records
• Healthcare applications containing patient information
• Cloud-based systems that store or process patient records
• Electronic communications containing identifiable health information

As healthcare organizations increasingly rely on digital systems, protecting ePHI requires appropriate administrative, physical, and technical safeguards.

The HIPAA Security Rule establishes requirements designed to protect the confidentiality, integrity, and availability of ePHI. Healthcare organizations must evaluate potential security risks and implement safeguards appropriate to their environments.

These protections may include encryption, access controls, multi-factor authentication, security monitoring, workforce training, and regular risk analyses.

How Is ePHI Different From PHI?

Why Protecting PHI Matters

Healthcare organizations face increasing cybersecurity, privacy, and compliance risks. Unauthorized disclosure of protected health information can result in regulatory penalties, reputational damage, operational disruption, and loss of patient trust.

As healthcare systems continue to adopt electronic medical records, telehealth platforms, cloud applications, and connected medical devices, safeguarding electronic protected health information becomes increasingly important. Organizations that understand how to protect PHI can reduce risk while supporting privacy, security, and HIPAA compliance objectives.

What Does HIPAA Require Organizations to Do to Protect PHI?

Understanding how to protect PHI is just as important as understanding what qualifies as protected health information.

The HIPAA Privacy Rule establishes standards governing how protected health information can be used and disclosed. It also provides patients with important privacy rights regarding access to their information and how that information is shared.

The HIPAA Security Rule focuses specifically on electronic protected health information and establishes requirements designed to protect its confidentiality, integrity, and availability. Organizations are expected to implement safeguards that help prevent unauthorized access, alteration, or loss of electronic health information.

The HIPAA Breach Notification Rule establishes notification requirements that may apply when unsecured PHI is compromised.

Organizations typically meet these obligations through a combination of administrative, physical, and technical safeguards. These safeguards work together to protect patient information and support compliance efforts.

Covered entities may also need Business Associate Agreements (BAAs) with third-party vendors or service providers that create, receive, maintain, or transmit PHI on their behalf. The BAA is a legally required document that defines how the third-party may access, use, disclose, and protect PHI that is handled on behalf of the HIPAA-covered entity. For example, if a clinic uses a software provider that stores patient information, the software provider is a Business Associate, and the BAA defines their responsibilities for protecting that data.

How to Protect PHI: Security Best Practices

Understanding how to protect PHI requires a layered approach that combines privacy, security, governance, and workforce awareness. Organizations that want to understand how to protect PHI effectively should implement administrative, physical, and technical safeguards that work together to reduce risk.

One of the most effective ways to protect protected health information is to limit access based on job responsibilities. Employees should only have access to the information they need to perform their assigned duties. Role-based access controls and least-privilege principles can significantly reduce unnecessary exposure.

• Multi-factor authentication (MFA) adds another important layer of protection. By requiring users to verify their identities using more than one authentication factor, organizations can reduce the risk of unauthorized access caused by stolen credentials.
• Healthcare organizations should also take steps to protect electronic protected health information through appropriate encryption and secure transmission practices. Encryption can help reduce risk when data is stored, transmitted, or backed up across systems and devices.
• Employee education remains critical. Workforce members should receive regular training on privacy obligations, phishing threats, safe handling procedures, and incident reporting responsibilities. HIPAA training should also include HIPAA basics, how to recognize protected information, appropriate use and disclosure of PHI, patient rights, access controls, breach awareness, and details regarding the consequences of violating organizational policies. Even strong technical safeguards can be undermined when employees are unaware of common risks.
• Monitoring and logging are equally important. Organizations should review access activity, investigate suspicious behavior, and maintain procedures for reporting and responding to potential incidents involving PHI.
• Vendor management also plays a significant role in protecting patient information. Organizations should evaluate vendors that handle PHI, understand their security practices, and establish appropriate contractual safeguards.

Finally, periodic risk analyses can help organizations identify vulnerabilities, evaluate existing controls, and strengthen their overall approach to protecting PHI.

Protect PHI With a Stronger Compliance Strategy

Understanding protected health information is the foundation of HIPAA compliance and healthcare cybersecurity. However, identifying PHI is only the first step. Organizations must also understand how to protect PHI, implement appropriate safeguards, and establish procedures that support the secure handling of electronic protected health information and other sensitive healthcare data.

Protecting PHI is not just about preventing cyberattacks. It also involves ensuring information is accessed, used, disclosed, and stored appropriately while supporting patient privacy and regulatory compliance requirements.

By combining workforce training, administrative safeguards, technical controls, vendor oversight, and ongoing risk management efforts, healthcare organizations can better protect protected health information, reduce compliance risks, and strengthen patient trust.

CampusGuard partners with healthcare organizations to strengthen their HIPAA compliance programs, improve cybersecurity controls, assess risks, and protect protected health information. Contact our team to learn how we can help support your privacy, security, and compliance objectives.

Frequently Asked Questions About PHI

What is protected health information under HIPAA?

Protected health information is individually identifiable health information related to healthcare, treatment, or payment for healthcare that is protected under HIPAA when handled by covered entities and business associates in applicable contexts.

What are examples of protected health information?

Examples include medical records, diagnoses, laboratory results, prescriptions, treatment plans, billing records, insurance claims, and patient communications that can be linked to an identifiable individual.

What are the 18 identifiers of PHI?

The HIPAA Safe Harbor method identifies 18 categories of identifiers, including names, medical record numbers, Social Security numbers, email addresses, IP addresses, biometric identifiers, and other information that may identify an individual.

Is a patient’s name considered PHI?

A patient’s name may be considered PHI when it is associated with healthcare, treatment, diagnosis, or payment information. A name alone does not automatically qualify as protected health information.

What is the difference between PHI and ePHI?

Electronic protected health information (ePHI) is PHI that exists in electronic form. Examples include electronic health records, patient portals, healthcare applications, and cloud-based healthcare systems.

Who is responsible for protecting PHI?

Covered entities and business associates generally share responsibility for protecting protected health information within the scope of their HIPAA obligations. Other privacy and security requirements may apply depending on the organization and the information involved.

What is electronic protected health information (ePHI)?

Electronic protected health information (ePHI) is individually identifiable health information that is maintained or transmitted electronically in a HIPAA-regulated context. Examples include electronic health records, patient portal information, digital medical images, electronic claims, and healthcare applications containing patient information.

Who qualifies as a HIPAA business associate?

A HIPAA business associate is generally an individual or organization that performs certain services or functions on behalf of a covered entity involving the use or disclosure of PHI. Examples include medical billing companies, cloud service providers, healthcare IT vendors, and third-party data storage providers.