Protected health information is any health information that can be tied back to a specific person and is held by a covered entity or its business associate.
The short answer
Protected health information, or PHI, is individually identifiable health information created, received, stored or transmitted by a HIPAA covered entity or business associate. Two conditions both have to hold: the information relates to health, care or payment for care, and it can be linked to a specific individual. Remove the link reliably and it stops being PHI.
The word doing the work is identifiable. A blood pressure reading with no name, account number, date or postcode attached is not protected health information. The same reading in a record with a patient ID is.
On this page
The two-part test
The 18 identifiers
HIPAA names eighteen categories of identifier. Presence of any one of them alongside health information makes the record PHI.
| Type | Identifiers |
|---|---|
| Direct | Name, social security number, medical record number, health plan beneficiary number, account number, certificate or licence number |
| Contact | Address more specific than state, telephone, fax, email address, URL |
| Digital | IP address, device identifiers and serial numbers |
| Temporal | All dates tied to an individual except year, and any age over 89 |
| Biometric | Fingerprints, voiceprints, full-face photographs and comparable images |
| Other | Vehicle identifiers, biometric identifiers and any other unique identifying code |
The one engineers usually miss
IP address is on the list. A web server log that records which IP viewed a page about a specific treatment, held by a covered entity, can be PHI. Application logs are in scope for the Security Rule just like the database is.
What is not PHI
| Data | Why it falls outside |
|---|---|
| Fitness tracker data you collect direct from consumers | You are not a covered entity or acting for one |
| Employment records held by an employer | Explicitly excluded, even when they contain health details |
| Student health records under FERPA | Governed by FERPA rather than HIPAA |
| Properly de-identified data sets | No longer individually identifiable |
| Aggregate statistics with no re-identification path | No link back to any individual remains |
De-identification
Safe Harbor
Strip all 18 identifier categories and have no actual knowledge the remainder can identify anyone.
Expert Determination
A qualified statistician documents that the re-identification risk is very small. Keeps more analytic value.
Limited data set
Neither of the above. Some identifiers remain, so it stays PHI and needs a data use agreement.
How Osto protects health data
Once you hold PHI, protecting it is an engineering problem: know where it lives, control who reaches it, encrypt it, and log every access. Osto covers those directly with data loss prevention, access control and MFA, encryption and logging and monitoring, mapped to the HIPAA safeguards inside the compliance platform alongside 200+ other frameworks.
Free security assessment
Know where patient data lives, and who reached it
Osto covers discovery, access control, encryption and audit logging for health data, mapped to the HIPAA safeguards.
Get a free security assessment Book a platform walkthroughHIPAA plus 200+ frameworks · Evidence from live controls · One platform, everything
Frequently asked questions
What is protected health information?
Individually identifiable health information created, received, stored or transmitted by a HIPAA covered entity or business associate. It must both relate to health, care or payment, and be linkable to a specific person.
What are the 18 HIPAA identifiers?
Eighteen categories including name, address below state level, all dates tied to an individual, telephone, email, social security number, medical record number, account number, IP address, device serial numbers, biometrics and full-face photographs.
Is an email address PHI?
On its own, no. An email address held by a covered entity alongside health information, such as an appointment confirmation, is PHI because it links a person to their care.
Is health data in a consumer app PHI?
Usually not. HIPAA applies to covered entities and their business associates. A direct-to-consumer wellness app collecting data itself is generally outside HIPAA, though other privacy laws still apply.
What is the difference between PHI and ePHI?
ePHI is the subset of PHI held or transmitted electronically. PHI on paper or spoken aloud is covered by the Privacy Rule; only ePHI triggers the Security Rule.