What are examples of PHI?
Definition
Protected health information (PHI) is health information that can identify a person, such as a medical record number, diagnosis tied to a name or an appointment date, when a HIPAA-covered organization holds or shares it.
- Category
- Data
- Also called
- protected health information, examples of protected health information
- Last updated
PHI is health information that is linked to an identifiable person and handled by a healthcare provider, health plan or healthcare clearinghouse, or their business associates. In the US, HIPAA's Privacy Rule protects it. The same diagnosis with no way to tie it to anyone is not PHI.
Examples of PHI
The HHS de-identification guidance lists 18 types of identifiers that make health data identifiable (they apply to you and to your relatives, employers and household members). Paired with health information, these are PHI:
- Names
- Geographic details smaller than a state, such as a street address, city or most of a ZIP code
- Dates tied to you, other than the year: birth date, admission and discharge dates, date of death, and ages over 89
- Telephone and fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and license plate numbers
- Device identifiers and serial numbers
- Web addresses (URLs) and IP addresses
- Biometric identifiers, such as fingerprints and voiceprints
- Full-face photos and comparable images
- Any other unique identifying number, characteristic or code
In practice, a lab result with your name on it is PHI. So is a billing record that shows your insurance ID and a procedure, or a clinic's appointment reminder with your phone number.
Where PHI stops
HIPAA covers healthcare providers, plans and clearinghouses and the companies that work for them. Health details you post yourself, or ones a fitness app or website collects, usually fall outside HIPAA, although other laws can apply. That gap matters: health information about you can sit in places with no HIPAA duties at all.
PHI vs. PII
PII (personally identifiable information) is the wider idea: any detail that can identify you. PHI is the health-related slice, tied to a covered entity. A name and address on a store loyalty card is PII but not PHI. The same name and address in a hospital's patient file is PHI.
How to protect yourself
- 1
Ask your provider how they handle your records
You have the right under HIPAA to see and get a copy of your records and to ask for corrections. Ask the practice's privacy officer who it shares them with.
- 2
Use the patient portal with a strong login
Use a unique password and two-step verification on your portal, insurer and pharmacy accounts.
- 3
Be careful with health details outside the clinic
Think before you put diagnoses or prescriptions into apps, forms or social posts. HIPAA often doesn't cover them there.
- 4
Check your insurance statements
Look at explanation-of-benefits letters for services you didn't get. They can be the first sign that someone is using your insurance ID.
- 5
Cut down who can look you up
Serus finds where your address and phone number are listed publicly and removes them, which makes it harder to match you to stolen health data.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a name PHI?
A name alone is not. It becomes PHI when it is linked to health information held by a covered entity, for example a patient list at a clinic.
Is a medical record number PHI?
Yes. It is on the list of 18 identifiers, and in a medical record it is tied to your health information.
How many identifiers does HIPAA list?
The Safe Harbor method of de-identification lists 18 types of identifiers that must be removed for health data to count as de-identified.
Is PHI the same as personal data under GDPR?
No. PHI is a US HIPAA term. Under GDPR health data is personal data and a special category with stricter rules.
Sources
Something wrong or out of date? Tell us and we'll re-check it.