What is protected health information (PHI)?
Protected health information (PHI) is any individually identifiable health information that a HIPAA covered entity or its business associate creates, receives, keeps or transmits, in any form, whether electronic, paper or spoken. In plain terms: if information can be tied to a specific person and relates to their health, their care or payment for their care, and your practice holds it, it is almost certainly PHI.
- PHI has two ingredients: it identifies (or could identify) a person, and it relates to health, care or payment for care.
- Appointment details count. The fact that a named person is booked at your practice is PHI.
- PHI covers every format: the EHR, a printed schedule, a voicemail, a text message and a conversation at the front desk.
- Any vendor that handles PHI for your practice is a business associate and needs a signed Business Associate Agreement first.
The definition, unpacked
The HIPAA definitions in 45 CFR 160.103 build PHI out of a few pieces. Health information is information about a person's past, present or future physical or mental health, the care they received, or payment for that care. It becomes individually identifiable when it identifies the person or there is a reasonable basis to believe it could be used to identify them. It becomes protected health information when a covered entity or business associate holds or transmits it.
That last condition matters. The same fact, say that a person has a sore knee, is not PHI when the person posts it on social media. It is PHI when it sits in a practice's chart or schedule.
Everyday examples in a practice
Many practices are surprised that scheduling data is PHI. It is: the fact that a specific person is a patient of a specific practice, at a specific time, relates to the provision of health care.
A useful habit is to ask two questions about any piece of information before it leaves the practice. Could someone tell who this is about? Does it say anything about their health, their care or paying for it? If both answers are yes, treat it as PHI and handle it accordingly: share it only for a permitted purpose, only with parties under the right agreements, and only as much as the task needs.
- The appointment schedule, including names, times and visit types.
- Clinical notes, diagnoses, medications and results.
- Insurance details, claims, statements and payment history.
- Patient phone numbers and email addresses kept in the practice's records.
- A voicemail left by a patient asking to move their visit.
- A text thread between the practice and a patient about an appointment.
- A sign-in sheet at the front desk, if it shows names and reason for visit.
The 18 identifiers
HIPAA's de-identification standard, in 45 CFR 164.514, lists 18 types of identifiers that must be removed, under the 'safe harbor' method, before health information is no longer considered identifiable. They are a useful checklist for spotting PHI:
- Names
- Geographic subdivisions smaller than a state, such as street address, city and most ZIP code digits
- All elements of dates (except year) directly related to the person, such as birth date, admission date or date of service, and ages over 89
- Phone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers, including license plates
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers, such as finger and voice prints
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic or code
What is not PHI
- De-identified data that meets HIPAA's safe harbor or expert determination standard.
- Employment records a covered entity holds in its role as an employer, such as a staff member's sick-leave note in a personnel file.
- Education records covered by FERPA.
- Information about a person who died more than 50 years ago.
- Health information held by organizations that are not covered entities or business associates, such as many consumer fitness apps, though other laws may still apply.
Why it matters to an independent practice
HIPAA requires covered entities to protect PHI with administrative, physical and technical safeguards, to use and disclose it only as the rules permit, to limit it to the minimum necessary for most purposes, and to notify patients and regulators of breaches. The practice stays responsible even when a vendor handles the data.
For a small practice, the most common risks are ordinary ones: a schedule emailed to a personal account, a vendor that never signed a BAA, a text that names the reason for a visit, a shared login. None of them requires a hacker. Knowing what counts as PHI is the first step to spotting them.
Common mistakes
- Assuming a schedule is not sensitive because it has no diagnoses.
- Sharing exports with vendors before a BAA is signed. See does my vendor need a BAA?
- Putting visit reasons in reminder texts or voicemails. Use the minimum necessary instead.
- Treating 'de-identified' loosely. Removing the name alone usually does not de-identify data.
- Forgetting spoken PHI. Conversations at the front desk count too; reasonable safeguards apply.
How DocsMD handles PHI
DocsMD signs a Business Associate Agreement with every practice before any patient data moves, including for the free leak audit. Data is encrypted at rest and in transit and kept in U.S. data centers, and patient data is never used to train AI. Patient texts carry only the practice name, times and numbered choices, never the patient's name or the reason for the visit. Details are on our HIPAA and BAA page.
Questions
Is a patient's phone number PHI?
When a practice holds it in connection with the patient's care, yes. A phone number is one of the 18 identifiers, and linked to a practice's records it identifies a patient.
Is an appointment time PHI?
Yes, when tied to an identifiable patient. The fact that a specific person has an appointment at a healthcare practice relates to their care.
Does PHI include paper and spoken information?
Yes. PHI covers any form or medium. Electronic PHI (ePHI) is the subset held or sent electronically, which the HIPAA Security Rule specifically addresses.
Is a patient's name alone PHI?
A name by itself, with no link to health, care or payment, is not health information. But a name in a practice's schedule or patient list is PHI, because it shows the person is a patient receiving care there.
Can we share PHI with a software vendor?
Only as HIPAA permits, typically under a signed Business Associate Agreement, and limited to the minimum necessary for the vendor's task.