Protected Health Information (PHI)

Under the Safe Harbor Method, PHI is defined by the presence of any of 18 specific identifiers. If a record contains health information and any one of these, it is PHI.

• Names (patient, relatives, employers)
• Geographic subdivisions smaller than a state (street address, city, county, zip code)
• Dates directly related to an individual (birth, admission, discharge, death)
• Telephone and fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers, including license plates
• Device identifiers and serial numbers
• Web URLs
• IP addresses
• Biometric identifiers (fingerprints, voice prints)
• Full-face photographic images and comparable images
• Any other unique identifying number, characteristic, or code

The core legal test for PHI is whether the information can be used to identify an individual. This is not limited to explicit identifiers like a name.

• Re-identification risk: A combination of seemingly innocuous data points (e.g., a rare diagnosis + a zip code + an age) can create a unique fingerprint that identifies a person.
• Expert Determination: A qualified statistician must certify that the risk of re-identification is very small for a dataset to be considered de-identified under this alternative method.
• Relatives & Household: PHI includes information that could identify not just the patient, but also their relatives, employers, or household members.

HIPAA protection is not limited to digital data. PHI exists in any form or medium.

• Electronic PHI (ePHI): Stored on a hard drive, in the cloud, on a USB stick, or transmitted via email. This is the primary focus of the HIPAA Security Rule.
• Physical PHI: Paper charts, printed lab results, X-ray films, and handwritten physician notes. These are protected by physical safeguards like locked cabinets.
• Verbal PHI: Oral communications containing identifiers, such as a hallway consultation about a named patient. The Privacy Rule requires reasonable safeguards for these discussions.

The regulatory boundary is crossed when PHI is successfully de-identified. Once de-identified, the data is no longer subject to HIPAA.

• Safe Harbor: Removal of all 18 identifiers and no actual knowledge that the remaining data could re-identify the individual.
• Expert Determination: A statistical analysis proves the risk of re-identification is vanishingly small.
• Limited Data Set: A middle ground where direct identifiers are removed, but dates and geography can remain. This is still PHI and requires a Data Use Agreement.
• Clinical AI Implication: Models trained on de-identified data do not process PHI, but the de-identification pipeline itself must be rigorously validated to prevent leaks.

PHI status is also defined by who holds the data. The same data point in different hands has different regulatory status.

• Covered Entities: Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically. They are directly subject to HIPAA.
• Business Associates: A person or entity that performs functions or activities involving the use or disclosure of PHI on behalf of a covered entity (e.g., a cloud AI provider, a billing company). They are contractually bound by a Business Associate Agreement (BAA).
• Non-Covered Entities: If a tech company collects the same health data directly from a consumer via a wellness app and is not acting on behalf of a covered entity, that data is generally not PHI under HIPAA (though it may be protected by other state or FTC regulations).

A core principle governing the use of PHI is that access must be limited to the minimum amount necessary to accomplish the intended purpose.

• Role-Based Access Control (RBAC): A billing clerk should not have access to full clinical notes; a researcher should not see direct identifiers.
• AI Processing: When an AI model processes clinical text for a specific task (e.g., prior authorization), the system should ideally only extract and expose the data elements required for that task, masking or ignoring all other PHI.
• Exception: This standard does not apply to disclosures for treatment to a healthcare provider, as the clinician needs the full picture.