What is PHI in healthcare?

In 1996, the Healthcare Insurance Portability and Accountability Act (HIPAA), which defines and protects sensitive health data of individuals, became federal law. From that point on, healthcare workers have taken great care to protect patients’ privacy. This is where PHI comes in. 

Protected health information, or PHI, in healthcare is any information about an individual’s health, treatment or payment record that can distinguish them from another individual. It differs from general medical information in that it is specific to that person. Medical information is anonymous data that has no identity markers.

According to the U.S. Electronic Code of Federal Regulations, PHI “is created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual.”

PHI in healthcare can be found in bills, digital files, referral letters, signed consent forms, doctors’ notes, lab results and prescription history. 

HIPAA establishes 18 identifiers that are considered PHI in healthcare: patient names, including full names, partial names or initials; geographical identifiers of patients, such as their address and including any subdivision smaller than a state, including street address, city, county and ZIP code; telephone numbers; fax numbers; email addresses; dates related to an individual’s health, such as their birth date, date of hospital admission, discharge date, or the date of their death; Social Security numbers, including full or partial; certificate or license numbers; images of a patient’s face; medical record numbers; health insurance beneficiary numbers; account numbers; vehicle identifiers, including certificates and license plates; device serial numbers; digital identifiers; Internet Protocol numbers; fingerprints, retinal prints and voice prints; and any other uniquely identifying numbers or codes.

While some of the above identifiers, such as birth date or ZIP code, can seem harmless on its own, their combination can create identifiable information.

For example: A hospital employee is talking to a family member about a patient she treated today. While she doesn’t give the person’s name, she mentions that the person works at a large business in town, gives their job title and mentions their injury and treatment date. Even without a name, her family member might be able to determine whom the information describes.

Anyone who works for a healthcare organization is responsible for protecting each patient’s PHI. This includes hospitals, clinics, dentists and pharmacies. Third-party vendors, such as billing companies or software apps, also need to follow HIPAA regulations.

This means that when healthcare organizations employ a contractor, they need to ensure that individual or company is prepared to protect any PHI to which they are exposed. That may mean having the company sign a form stating that it is responsible for any employee’s indiscretion.

The privacy rule also covers health plans. This includes employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. However, a group health plan with fewer than 50 participants and that’s administered solely by the employer, which establishes and maintains the plan, is not a covered entity.

Typically, records that are considered PHI in healthcare include medical histories and notes, including the results of physical exams and hospital discharge summaries; tests and lab results, including blood tests, imaging tests and pathology reports; prescriptions and pharmacy files, such as types of medications taken and refill records; billing and insurance files, including claim forms and payment histories; and digital communications, such as through patient portals.

However, not every healthcare record is considered PHI. Exceptions include school records, including student immunization files; employment files, such as sick leave notes or medical fitness tests that the employer keeps; and consumer apps that store fitness tracker data and other health information.

While healthcare organizations are responsible for protecting patients’ health information, they do, of course, need to use that information to perform their job.

The following are uses and disclosures that do not require patient authorization: treatment, including sharing data to coordinate healthcare among several providers; payment, including billing a patient’s insurance company, determining coverage eligibility or obtaining reimbursement; and operations, including quality assessment, employee training and legal audits.

Most other uses require a signed consent form from the patient, detailing the dates and diagnoses to be disclosed. Healthcare providers are barred from sharing information without a signed form in the following situations: marketing and sales; providers sharing psychotherapy notes outside of standard treatment; and disclosures to third parties or employers not covered by the standard exceptions.

Patients have the right to access copies of their medical records; request corrections to errors; receive a log of where PHI was shared outside of treatment and payment request restrictions, such as blocking health plan disclosure for out-of-pocket services paid in full; and receive a written breakdown of how the organization protects PHI.

To protect patients’ protected information, healthcare organizations employ administrative, physical and technical safeguards to help ensure they remain in compliance.

Administrative safeguards include vetting outside contractors to make sure they follow privacy rules, checking systems to fix security problems, giving workers access only to the information they need for their jobs, and training staff members to spot risks such as phishing and other security challenges.

Physical safeguards include securing electronic devices such as laptops and tablets so that they can’t be stolen, designating specific private areas in which to talk about patient care, and keeping paper files and computer servers in locked areas.

Technical safeguards include requiring multifactor authentication for system login, backing up data to guard against cyberattacks, using strong encryption to protect data from being stolen, and tracking who looks at patient files.

Training to protect PHI should begin the moment new employees are hired. But it shouldn’t stop there — organizations need to continually introduce new topics and offer additional information to seasoned employees.

A few important training topics are:

• Minimum necessary rule: Teaching staff to share and access only the specific data needed for their exact job duties
• Real-world simulations: Including overheard conversations and wrong-recipient emails
• Incident reporting: Showing staff how to report accidental disclosures to their supervisor

A PHI breach is when an organization shares one or more patients’ protected health information — either by accident or by intent. Once this information is known, the organization needs to determine if the health information was acquired or viewed by anyone who wasn’t permitted to see it.

If a healthcare organization or third-party vendor suspects it has exposed one or more patients’ PHI, it may take the following steps:

1.     Fix the risk: Stop the leak, change passwords or other codes and wipe lost gadgets.

2.     Tell patients: Send a written notice to patients by mail or email within 60 days.

3.     Tell the government: According to the HIPAA Breach Notification Rule, organizations need to notify the Secretary of the U.S. Department of Health and Human Services if the breach affects 500 or more individuals.

4.     Tell the news: If the breach affects 500 or more people in one state, the media should be informed.

The U.S. Department of Health and Human Services Office for Civil Rights is the government office responsible for enforcing HIPAA and imposing penalties. Typically, it uses a tiered structure for penalties that varies depending on the type of violation.:

•  Unknowing violation: $100-$50,000 per violation, with an annual maximum of $25,000 for repeat violations
• Reasonable cause: $1,000-$50,000 per violation, with an annual maximum of $100,000 for repeat violations
• Willful neglect that is corrected within the required time period: $10,000-$50,000 per violation, with an annual maximum of $250,000 for repeat violations
• Willful neglect that is not corrected within the required time period: $50,000 per violation, with an annual maximum of $1.5 million

The U.S. Department of Justice handles criminal violations, which can include higher fines and prison time for the involved parties.

This information was reviewed and current as of 10/14/2026.

PHI in healthcare is just one of many topics covered in higher education healthcare programs. Individuals who pursue such degrees can also learn about big data in healthcare and health informatics, among other courses of study.

University of Phoenix offers programs in healthcare, including:

• Bachelor’s degrees in healthcare
• Master’s degrees in healthcare
• Doctoral degrees in healthcare
• Healthcare certificates

For more information, contact University of Phoenix.