- PHI (protected health information) is any individually identifiable health information that a HIPAA covered entity or business associate creates, receives, or maintains.
- Data becomes PHI when health, treatment, or payment information is combined with an identifier, such as a name, address, or account number.
- The U.S. Department of Health and Human Services (HHS) lists 18 identifiers that, when paired with health data, make that data PHI.
- PHI is a subset of personally identifiable information (PII). All PHI is PII, but not all PII is PHI.
- Organizations that mishandle PHI face HIPAA fines, breach notification obligations, and reputational damage, making PHI discovery and monitoring a core data security priority.
What Is PHI?
PHI, or protected health information, is any individually identifiable health information created, received, or maintained by a HIPAA covered entity or business associate. It covers a patient's medical records, treatment history, and payment information, along with any identifier, such as a name or medical record number, stored in the same record. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule defines and regulates PHI in the United States.
PHI only exists where two conditions are both true: the information relates to a person's past, present, or future physical or mental health, healthcare, or payment for healthcare, and it can be tied to that specific person. A lab result on its own is health information. A lab result linked to a patient's name is PHI. This distinction matters for security teams because it determines which data stores, applications, and workflows fall under HIPAA's technical, administrative, and physical safeguard requirements.
What Qualifies as PHI?
Not every piece of health-related data is considered PHI. To qualify, information must meet the two-part test above: it must be identifiable, and it must relate to health, treatment, or payment. This broad standard means PHI covers far more than medical charts.
A single data point can also qualify on its own. A photo of a newborn on a hospital's patient wall is PHI because it identifies someone who, by implication, received care. Conversely, the same lab value with every identifier stripped out is de-identified health information, which HIPAA does not regulate.
The 18 HIPAA Identifiers That Make Data PHI
HHS defines 18 identifiers that, when linked to health, treatment, or payment information, turn that data into PHI. Under HIPAA's "safe harbor" method, all 18 must be removed before information is considered de-identified.
- Names
- Geographic subdivisions smaller than a state (address, city, ZIP code)
- Dates tied to an individual, other than year (birth date, admission date, discharge date)
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers, including fingerprints and voiceprints
- Full-face photographs
- Any other unique identifying number, characteristic, or code
This list was published in 1999 and has not kept pace with newer identifiers, such as social media handles or device fingerprints, that can still re-identify a patient. Organizations should treat it as a floor, not a ceiling, when classifying sensitive health data.
PHI vs. PII: What's the Difference?
Personally identifiable information (PII) is any data that can identify a specific person, such as a name, Social Security number, or driver's license. PHI is a subset of PII: it is PII combined with health, treatment, or payment information and held by a covered entity or business associate.
A name alone is PII. That same name attached to a diagnosis, a prescription, or a hospital bill becomes PHI, and it inherits HIPAA's stricter handling requirements on top of general data privacy obligations. This is why security teams cannot treat PHI and PII as interchangeable categories in a data classification policy. A tool that only detects generic PII patterns, such as Social Security numbers, will miss PHI where the identifier is more subtle, like a patient name mentioned in a clinical note.
PHI vs. ePHI: What's the Difference?
Electronic protected health information (ePHI) is PHI that exists in electronic form, such as records in an electronic health record (EHR) system, a PDF diagnostic report, or an email containing a patient's treatment plan. PHI is the broader category and includes information in any medium, including paper records and spoken conversations.
The distinction matters because HIPAA regulates the two through separate rules. The HIPAA Privacy Rule governs PHI generally, regardless of format. The HIPAA Security Rule applies specifically to ePHI and requires administrative, physical, and technical safeguards, such as encryption, access controls, and audit logging, to protect electronic records from unauthorized access.
Why PHI Matters for Data Security and Compliance
PHI is one of the highest-value targets in cybercrime because, unlike a credit card number, a medical history cannot be canceled or reissued. Stolen PHI fuels insurance fraud, identity theft, and targeted extortion, which is why healthcare breaches consistently carry some of the highest per-record costs of any industry.
For organizations, the stakes extend beyond the immediate breach. A HIPAA violation can trigger fines from HHS's Office for Civil Rights, mandatory breach notifications, and long-term reputational damage as part of a broader data compliance program. PHI also frequently moves outside the systems built to protect it: a clinician pastes a note into a personal AI assistant, a billing coordinator emails a claim to the wrong recipient, or a contractor uploads patient records to an unsanctioned cloud drive. Preventing that kind of movement takes as much attention as encryption or access controls.
Common Risks and Misconceptions About PHI
- Assuming legacy DLP catches PHI reliably: Content-inspection tools that only match patterns, such as Social Security number formats, miss PHI where the identifier is contextual, like a patient's name in a chat message.
- Believing de-identified data is always safe to share: Data is only de-identified once all 18 HIPAA identifiers are removed. Partial removal still leaves PHI subject to HIPAA.
- Confusing employer health records with PHI: Health information an employer holds as part of an employment record, such as a workers' compensation file, is generally not PHI under HIPAA.
- Overlooking business associates: Any vendor that creates, receives, or transmits PHI on behalf of a covered entity, such as a billing service or cloud storage provider, must also comply with HIPAA.
- Treating PHI risk as solely an external threat: Misdirected emails, personal device use, and unsanctioned file sharing by employees account for a significant share of reported PHI exposure.
How to Protect PHI and Stay HIPAA Compliant
- Discover and classify PHI across every system
Apply consistent data classification to identify where clinical, payment, and administrative PHI lives, including unmanaged cloud apps and endpoints, not just the electronic health record system. - Apply role-based access controls
Limit access control to PHI to the minimum necessary for each person's job function, in line with HIPAA's minimum necessary standard. - Monitor how PHI moves
Track PHI as it is copied, pasted, uploaded, or shared, so unusual movement, such as a bulk export to a personal account, is flagged before it becomes a breach. - Encrypt PHI at rest and in transit
Encryption is one of the most effective safeguards for ePHI under the HIPAA Security Rule. - Train the workforce continuously
Most PHI exposure results from human error, not malicious intent, so ongoing training reduces risk more than technology alone. - Maintain audit logs and conduct regular risk assessments
Document access to PHI and review safeguards periodically to identify gaps before regulators or attackers do.
How Cyberhaven Addresses PHI Protection
Cyberhaven addresses PHI protection through a Unified AI & Data Security Platform that combines data loss prevention (DLP), data security posture management (DSPM), and AI Security to trace PHI from creation through every copy, paste, and share. Unlike tools that rely on content pattern matching alone, Cyberhaven's platform uses Data Lineage to understand where PHI originated and how it has moved, so it can identify PHI even when it lacks an obvious pattern, such as a patient name embedded in a clinical note.
DSPM discovers and classifies PHI across managed and unmanaged systems, giving security teams visibility into where PHI lives before it becomes a compliance gap. DLP then enforces policy in real time, stopping actions like uploading patient records to a personal cloud account or pasting medical data into an unauthorized AI tool, while educating users on HIPAA policy without disrupting clinical workflows. AI Security extends this protection to PHI shared with generative AI tools, a growing source of exposure as clinical and administrative staff adopt AI assistants.
Frequently Asked Questions
What does PHI stand for?
PHI stands for protected health information. It refers to individually identifiable health, treatment, or payment information that a HIPAA covered entity or business associate creates, receives, or maintains.
What is the difference between PHI and PII?
PII is any data that can identify a person, such as a name or Social Security number. PHI is PII combined with health, treatment, or payment information and held by a covered entity or business associate. All PHI is PII, but not all PII is PHI.
What are examples of PHI?
Examples of PHI include lab results, diagnoses, prescriptions, insurance claims, billing statements, and appointment records, when any of these are linked to an identifier such as a name, medical record number, or address.
Is de-identified health information considered PHI?
No. Health information is only de-identified once all 18 HIPAA identifiers are removed under the safe harbor method. HIPAA does not apply to properly de-identified data.
What is ePHI?
ePHI is protected health information that exists in electronic form, such as records in an electronic health record system or an email containing treatment details. ePHI falls under the HIPAA Security Rule, which requires specific technical safeguards like encryption and access controls.
Who is required to protect PHI under HIPAA?
Covered entities, including healthcare providers, health plans, and healthcare clearinghouses, must protect PHI under HIPAA. Business associates, such as billing companies or cloud vendors that handle PHI on a covered entity's behalf, are also required to comply.
.avif)
.avif)
