DataTerminology.comNEW
Any individually identifiable health information protected under HIPAA, including medical records and related demographic data.
DESCRIPTION
Protected Health Information (PHI) includes medical histories, lab results, insurance details, and any data that can identify a patient’s health status or care. HIPAA’s Privacy and Security Rules govern its use, disclosure, and safeguarding. Covered entities and business associates must implement administrative, physical, and technical safeguards. De-identification standards permit certain uses without PHI. Violations can result in substantial penalties and corrective actions.
ALTERNATIVE DEFINITIONS
U.S. Department of Health & Human Services
Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media.
Defines scope across covered entities, associates, and forms/media.
HIPAA Journal
PHI is information that relates to the past, present, or future physical or mental health condition, healthcare provision, or payment, and that identifies the individual.
Highlights health, care, payment aspects plus identifiability requirement.
RELATED TERMS
HIPAA Data De-identification Privacy Rule Security Rule Covered Entity Business Associate Minimum Necessary ePHI Consent
COMPETING TERMS
PII
RELATIONS
- Broader: Information
KNOWLEDGE AREAS
Data Privacy & Compliance Data Security Data Management
TARGET AUDIENCE
Data Governance Manager Chief Information Officer Data Steward Data Architect Data Management Consultant
EXTERNAL SOURCES
- Wikipedia - Protected health information
- HHS - HIPAA Privacy Rule overview
- HHS - HIPAA Security Rule overview
- NIST - HIPAA Security Rule toolkit
TOP QUESTIONS
What is Protected Health Information (PHI)?
PHI is individually identifiable health information covered by HIPAA, including medical records and related demographic data.
Category: Overview
Who must protect PHI under HIPAA?
Covered entities (providers, plans, clearinghouses) and business associates must protect PHI.
Category: Requirements
What are common PHI security safeguards?
Administrative policies, physical protections, and technical controls like encryption and access management.
Category: Management
How is PHI different from PII?
PII identifies individuals; PHI also relates to health status, care, or payment and is specifically regulated by HIPAA.
Category: Distinction
What is the minimum necessary standard for PHI?
Use or disclose only the minimum PHI needed to accomplish the intended purpose.
Category: Best practices
How can PHI be de-identified?
By removing specified identifiers or through expert determination that risk of re-identification is very small.
Category: Requirements
What are risks of mishandling PHI?
Legal penalties, breach notifications, reputational damage, and patient harm can result.
Category: Risk
Is electronic PHI (ePHI) treated differently?
ePHI is subject to the Security Rule, requiring specific technical safeguards and risk management.
Category: Example
When was HIPAA enacted?
HIPAA was enacted in 1996, with Privacy and Security Rules finalized in subsequent years.
Category: Origin