What is the difference between PHI and PII?
Definition
PHI is health information tied to a specific person and held by a healthcare provider, health plan or their partners, which HIPAA protects. PII is the broader category: any information that can identify a person.
- Category
- Data
- Also called
- protected health information, PHI vs PII
- Last updated
PII (personally identifiable information) is NIST's name for information that can be used to distinguish or trace an individual's identity, such as name, Social Security number or biometric records, either alone or combined with other information that is linked or linkable to that person, like date and place of birth.
PHI (protected health information) is a term from US health privacy law. HHS explains that the HIPAA Privacy Rule covers individually identifiable health information that a covered entity or its business associate holds or transmits in any form. Covered entities are health plans, healthcare clearinghouses and those healthcare providers that run certain transactions electronically.
How they relate
Every piece of PHI is also PII, because it identifies a person. Not all PII is PHI. HHS's guidance says a name or phone number on its own isn't PHI. It becomes PHI when it is linked to health information, for example when it shows that a person was treated at a particular clinic.
An example
Your name and home address in a people-search listing is PII. The same name in a hospital's records next to your diagnosis is PHI, and the hospital has legal duties about how it uses and shares it.
Why it matters
HIPAA binds the clinic, insurer and their partners, not everyone who holds information about your health. Health details you share with a general app or a website may not get HIPAA protection at all, though other laws can apply. It's worth knowing which rules cover which of your data before you decide to share it.
How to protect yourself
- 1
Ask who is covered before you share health details
Ask a provider, insurer or app whether they are a HIPAA covered entity. A fitness or wellness app often isn't.
- 2
Use your right to see your records
Under the Privacy Rule you can ask a covered provider or insurer for copies of your health records. Check them for errors.
- 3
Share the minimum
Give health details only where they're needed, and be careful with forms that ask for more than the service requires.
- 4
Keep your general PII out of data broker listings
Your name, address and phone number are PII even when no health data is attached. Serus finds where they are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is PII the same as PHI?
No. PII is any identifying information. PHI is health information tied to a person and handled by entities HIPAA covers. PHI is a type of PII, but most PII isn't PHI.
Is my name PHI?
Not by itself. HHS's guidance says identifiers like names become PHI when linked to health information, such as treatment at a clinic.
Does HIPAA protect health data I give to an app?
Only if the app is run by or for a covered entity or its business associate. Many consumer apps are neither. Check the privacy policy.
Sources
Something wrong or out of date? Tell us and we'll re-check it.