What is Protected Health Information (PHI)?
Protected Health Information (PHI) is individually identifiable health information that is held or transmitted by a HIPAA covered entity or a business associate, in any form. If your company handles it on behalf of a healthcare provider or health plan, HIPAA applies to you as a business associate.
What counts as PHI
Information is PHI when two things are true. It relates to a person’s past, present or future physical or mental health, to the care they receive, or to payment for that care. And it identifies the person, or there is a reasonable basis to believe it could. A name with an appointment date qualifies. So does a billing record or an email address linked to a diagnosis.
Who holds the data matters as much as what it is. Health data is PHI only when a covered entity (a health plan, a healthcare clearinghouse, or a healthcare provider that conducts standard electronic transactions) or one of its business associates holds or transmits it. The same heart-rate data in a consumer fitness app with no link to a covered entity is usually not PHI, although other laws may still apply.
- Excluded. Employment records a covered entity holds as an employer, and education records covered by FERPA.
- Time limit. Information about a person who died more than 50 years ago is no longer PHI.
PHI and ePHI
The HIPAA Privacy Rule protects PHI in every form, including paper and conversation. The Security Rule covers the electronic subset, ePHI, and sets administrative, physical and technical safeguards for it: risk analysis, access control, audit logging, integrity controls and transmission security, among others.
For a software vendor, almost all PHI is ePHI. A business associate must sign a Business Associate Agreement with the covered entity, meet the Security Rule, and report breaches of unsecured PHI to the covered entity.
De-identified data
Data that has been de-identified under HIPAA is no longer PHI. There are two methods. Safe Harbor removes 18 listed identifiers, such as names, most dates and most geographic detail smaller than a state, and requires that the organisation has no actual knowledge the rest could identify someone. Expert Determination relies on a qualified expert concluding that the risk of re-identification is very small.
Removing names alone is not de-identification. Dates of service, device identifiers and free-text notes often carry enough to identify a person.
Questions
Protected Health Information (PHI), answered
Is PHI the same as health data under GDPR?
No. PHI is a HIPAA term and depends on who holds the data. GDPR treats data concerning health as a special category of personal data whoever processes it, so an organisation can hold health data under GDPR that is not PHI under HIPAA.
Is an email address PHI?
On its own, no. It becomes PHI when a covered entity or business associate holds it together with health, care or payment information about the person.
Does encrypting PHI take it out of HIPAA?
No. Encrypted PHI is still PHI. Encryption that meets HHS guidance does mean a lost or stolen copy is not treated as a breach of unsecured PHI, which changes the notification duties.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them