What is protected health information?
Protected health information (PHI) is the HIPAA term for health information that identifies a person and is created, received, kept or sent by a covered entity or its business associate. It covers information about a person's past, present or future physical or mental health, the care they received and payment for that care, in any form: an electronic record, a paper chart, a fax or a phone conversation. Electronic PHI, or ePHI, is the subset the HIPAA Security Rule protects.
What makes health data PHI is who holds it. A diagnosis in a hospital's records is PHI; the same diagnosis in a consumer fitness app that isn't working for a health care provider or plan generally isn't, though other laws may still apply. Records a covered entity keeps in its role as an employer, such as a sick note in an HR file, are also excluded.
Who has to protect PHI
- Covered entities: health plans, health care clearinghouses, and health care providers that conduct standard transactions, such as claims, electronically.
- Business associates: vendors that create, receive, maintain or transmit PHI for a covered entity, such as billing companies, cloud record hosts, IT managed service providers and shredding services. They sign a business associate agreement (BAA) and are directly liable for complying with the Security Rule.
The 18 identifiers
HIPAA's Safe Harbor de-identification method lists 18 types of identifier that must be removed before health data stops being PHI: names; geographic units smaller than a state, such as street address, city and full ZIP code; all elements of dates except the year, and ages over 89; phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers, including license plates; device identifiers and serial numbers; URLs; IP addresses; biometric identifiers such as fingerprints and voiceprints; full-face photos and comparable images; and any other unique identifying number, characteristic or code. The list is a de-identification checklist, not the definition of PHI, and health data that still contains any of them is not de-identified under Safe Harbor.
Protecting PHI
The Security Rule requires administrative, physical and technical safeguards for ePHI, starting with a documented risk analysis. Typical controls are unique user IDs and role-based access, audit logging of record access, encryption of laptops, backups and transmissions, workforce training, and BAAs with every vendor that touches PHI. The Privacy Rule adds the minimum necessary standard: use and disclose only as much PHI as a task requires. Under the Security Rule as it has long stood, encryption is an addressable specification rather than an absolute requirement, though it is expected in practice and HHS has proposed making it required. PHI encrypted to HHS guidance counts as secured, so losing an encrypted laptop isn't a reportable breach as long as the key wasn't exposed too.
Example: a lost laptop
A home health nurse's unencrypted laptop holding visit notes for 1,200 patients in one state is stolen from a car. That is a breach of unsecured PHI. The agency must notify each affected patient without unreasonable delay and no later than 60 days after discovery, notify the Department of Health and Human Services, and, because more than 500 residents of one state are affected, notify prominent media outlets in that state. Had the drive been encrypted with its key kept separately, none of those notifications would have been needed.
PHI vs. PII
PII is the broader idea of any information that identifies a person, governed by many laws. PHI is a specific HIPAA category: identifiable health information in the hands of covered entities and business associates. A patient's name and diagnosis at a clinic are both PII and PHI; the same person's name in a retailer's loyalty database is PII but not PHI. GDPR has no PHI category but treats health data as a special category that needs extra protection.
Protected health information on the CompTIA Security+ exam
Health data is one of the regulated data types in SY0-801 objective 3.3, which covers protecting data, and PHI is the HIPAA term for it. Wording such as "patient records", "a clinic's billing vendor" or "a hospital must protect diagnoses and treatment notes" points to PHI and HIPAA. Distractors include PCI DSS, which governs cardholder data; PII used generically when the scenario is clearly about a health care provider; GDPR, when the setting is a U.S. hospital; and the 18 identifiers presented as if they were the definition of PHI.