Glossary
PHI (protected health information)
Also called: Protected health information
In one sentence
PHI is any health information that can be linked to a specific person and is created or held by a healthcare provider, health plan or their vendors.
HIPAA defines protected health information (45 CFR 160.103) as individually identifiable health information — information about a person's past, present or future health, the care they received, or how they paid for it — when it's held or sent by a covered entity or business associate. The key word is identifiable: a diagnosis on its own isn't PHI, but a diagnosis next to a name, date of birth, phone number, address, photo, account number or similar identifier is.
PHI isn't only clinical notes. Appointment schedules, insurance cards, billing statements, X-rays with a name on them, voicemails from patients and even a sign-in sheet at the front desk can all contain it. When PHI is stored or sent electronically, it's called ePHI, and that's what the HIPAA Security Rule protects.
Why it matters: almost every decision about your practice's IT — which email service you use, whether laptops are encrypted, who can open the scheduling system — comes back to where PHI lives and who can reach it. You can't protect what you haven't found, which is why a risk assessment starts by mapping it.
Example: a medical office manager exports a list of patients due for follow-up into a spreadsheet and emails it to her personal Gmail to work on at home. That spreadsheet is PHI, it has now left the practice's protected systems, and the email provider has no BAA with the practice. The fix is giving her secure access to the practice's own files from home instead.
Related terms
- ePHI (electronic protected health information)ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- Business associate agreement (BAA)A BAA is the written contract HIPAA requires between a covered entity (like your practice) and any vendor that creates, receives, stores or transmits patient information on your behalf.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- DLP (data loss prevention)Tools and policies that spot sensitive information — like Social Security numbers or patient records — and stop it from being shared where it shouldn’t go.