HIPAA Glossary · Data & information types
PHI
Also: protected health information
Protected health information — individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
Context
PHI is the central object HIPAA protects. "Any form" means paper, electronic, or oral — a conversation at a reception desk about a patient is PHI just as much as the EHR record. The identification criteria are broad: direct identifiers like name obviously qualify, but so do indirect combinations that could reasonably identify an individual.
Related terms
- ePHI — PHI in electronic form — the subset the Security Rule protects.
- IIHI — Individually identifiable health information — health information that identifies an individual or could reasonably be used to.
- De-identification — Removing identifiers so information is no longer PHI and falls outside HIPAA. Two accepted methods: Expert Determination and Safe Harbor.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.