Protected Health Information: A Complete Guide

Protected health information (PHI) includes certain health data that can identify a person. Protecting this information helps keep sensitive patient details private and secure.

HIPAA sets rules for how covered entities and business associates handle PHI. These rules cover how PHI is used, shared, stored, and protected.

The risks are significant. In 2024, 663 large PHI breaches affected about 242.9 million people.

This guide explains what qualifies as PHI and provides common examples. It also covers key HIPAA requirements and how to protect PHI when working with third parties.

Under HIPAA, protected health information (PHI) is certain health information that can identify a person. It can relate to someone’s health, healthcare services, or payment for care.

PHI can include information about a person’s past, present, or future health. It can also cover patient care and how that care is paid for.

Context matters when deciding whether information is PHI under HIPAA. An email address alone is not always PHI. However, it may become PHI when linked to health information in a HIPAA-covered setting.

HIPAA applies to PHI held or shared by covered entities and their business associates. This can include healthcare providers, health plans, and certain outside service providers.

What is the difference between PHI and ePHI?

Electronic protected health information (ePHI) is PHI in electronic form. It includes PHI created, received, stored, or sent electronically.

Common examples include electronic health records (EHRs), digital medical reports, and electronic billing information.

The HIPAA Security Rule specifically protects ePHI. It sets standards for keeping this electronic information secure.

Health data may be PHI if it can identify a person. Both the health details and identifying information matter.

Common protected health information examples include:

• Medical records
• Diagnoses
• Lab and test results
• Prescription information
• Medical bills
• Insurance information
• Messages between patients and providers

These records may contain details that identify a person. A name is one example. Other details can also reveal who the health information belongs to.

The 18 HIPAA identifiers

HIPAA has two methods for PHI de-identification. One is called the Safe Harbor method.

This method requires organizations to remove certain details from health data. These are known as the 18 HIPAA identifiers:

1. Names
2. Geographic details smaller than a state
3. Certain dates linked to a person
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. URLs
15. IP addresses
16. Biometric identifiers, such as fingerprints
17. Full-face photos and similar images
18. Other unique identifying numbers, features, or codes

Removing these details is one part of the Safe Harbor method. The remaining data must not contain information that the organization knows could identify the person.

What is not considered PHI?

Not all personal or patient health information is PHI under HIPAA.

Properly de-identified health data is one example. De-identification means removing information that could identify the person. Once data meets HIPAA’s de-identification rules, it is no longer PHI.

Context also matters. Health information does not become PHI just because it relates to someone’s health.

For example, HIPAA does not cover every company that collects health information. PHI rules generally apply when covered entities or business associates handle the information.

Other privacy laws may still protect data that falls outside HIPAA.

HIPAA sets rules for how organizations handle and protect PHI. These HIPAA PHI requirements apply to covered entities and their business associates.

HIPAA covered entities include many healthcare providers, health plans, and healthcare clearinghouses. HIPAA business associates are outside organizations that handle PHI for covered entities.

HIPAA privacy and security requirements help protect PHI. Two key rules are the Privacy Rule and Security Rule.

The HIPAA Privacy Rule

The HIPAA Privacy Rule sets standards for using and sharing PHI. It also gives patients certain rights over their health information.

HIPAA allows PHI to be used or shared in certain situations. For example, providers can use PHI for treatment, payment, and healthcare operations.

In many cases, organizations must follow the “minimum necessary” standard. This means limiting PHI to what is needed for the task.

The HIPAA Security Rule

The HIPAA Security Rule focuses on electronic protected health information, or ePHI. It requires organizations to protect the confidentiality, integrity, and availability of ePHI.

The rule groups PHI safeguards into three areas:

• Administrative safeguards: Policies and processes for managing security risks.
• Physical safeguards: Steps that protect facilities, devices, and systems.
• Technical safeguards: Technology that controls and protects access to ePHI.

For example, access controls can limit who can view electronic health records. Security policies can also guide how staff handle sensitive data.

These data protections are important as cyber threats grow. In 2024, hacking and IT incidents caused 81% of reported large PHI breaches.

Strong PHI data security requires more than secure software. Healthcare organizations need clear rules for how people access, use, and share sensitive data.

The scale of the risk has also changed. From 2018 to 2023, large healthcare breaches increased by 102%. The number of people affected jumped by 1,002%.

Good PHI compliance for healthcare organizations includes:

• Assessing risks to PHI on a regular basis
• Limiting PHI access based on job responsibilities
• Training employees on safe data handling
• Protecting both physical and electronic records
• Using security controls to prevent unauthorized access
• Monitoring how third parties access and handle PHI

PHI protection also extends beyond an organization’s own team. Outside partners may need access to PHI to provide certain services.

PHI and HIPAA business associates

A HIPAA business associate is a person or company that performs certain services for a covered entity involving PHI. This can include some billing, technology, and support providers.

An outsourcing partner may be a business associate if its work involves PHI. This means healthcare organizations need to consider PHI and healthcare outsourcing together when choosing outside providers.

A Business Associate Agreement (BAA) is generally required when a vendor acts as a business associate. It sets out how the business associate can use and protect PHI.

What to look for in a healthcare outsourcing partner

Outsourcing work does not remove an organization’s HIPAA responsibilities. Any partner handling PHI should have clear safeguards in place.

When considering HIPAA compliant outsourcing, healthcare organizations should review:

• Access controls and security measures
• Employee privacy and security training
• PHI storage and handling practices
• Processes for responding to security incidents
• Ability to sign a BAA when required
• Clear responsibilities for protecting PHI

Strong healthcare outsourcing HIPAA compliance starts with knowing who can access PHI. Organizations should also understand how each partner protects that information.

Protecting PHI starts with knowing where sensitive data lives. Healthcare organizations also need to know who can access it.

That includes employees and outside partners. As operations grow, third-party access should remain part of your wider PHI compliance approach.

Horatio provides outsourced customer support and back-office services for healthcare organizations. Our teams work within defined security and data-handling processes to help protect sensitive information.

If you’re looking to scale your healthcare operations with an experienced outsourcing partner, we can help. Learn more about Horatio’s healthcare outsourcing services or contact our team today.

What are examples of protected health information?

PHI can include medical records, diagnoses, lab results, billing records, and insurance information. These records are PHI when they contain information that can identify a person.

What is the difference between PHI and PII?

Personally identifiable information (PII) is information that can identify a person. PHI is health information protected under HIPAA.

The two can overlap, but they are not the same. Whether information is PHI depends on its healthcare context and who handles it.

Can healthcare organizations share PHI with third parties?

Yes, HIPAA allows PHI to be shared with third parties in certain situations. The organization must follow the relevant HIPAA rules.

A business associate agreement (BAA) may be required when a third party handles PHI as a business associate.