{"head":{"title":"What Is PHI (Protected Health Information)? | OceanLab","description":"PHI is identifiable health information held by a HIPAA covered entity or business associate. What counts as PHI, what does not, and what it means for apps.","canonical":"https://oceanlab.in/glossary/phi"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"PHI","path":"/glossary/phi"}],"slug":"phi","term":"PHI (protected health information)","aka":["protected health information","ePHI"],"category":"Compliance","short":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.","body":[["HIPAA defines PHI in 45 CFR 160.103 as individually identifiable health information, in any form, held or sent by a covered entity (a health plan, a healthcare clearinghouse, or a provider that bills electronically) or by its business associate. It covers a person's health, the care they receive and payment for that care, when it is linked to something that identifies them, such as a name, dates, contact details or a record number."],["PHI stored or sent electronically is often called ePHI, and the HIPAA Security Rule sets the safeguards for it. Data that has been properly de-identified under 45 CFR 164.514 is no longer PHI. Some records are excluded, such as employment records a covered entity holds as an employer."]],"why":["Whether your software handles PHI decides whether HIPAA applies to you at all. If it does, you need a ",{"href":"/glossary/baa","text":"BAA"}," with each covered entity customer, Security Rule safeguards such as access control, audit logs and encryption, and a breach process. If it does not, other rules may still apply."],"example":["A scheduling app used by a dental practice stores patient names, appointment times and the treatment booked. Because the practice is a covered entity and the app holds that data on its behalf, the data is PHI and the app vendor is a business associate."],"inBuild":null,"mistakes":[["Thinking only diagnoses count. An appointment linked to a name can be PHI."],["Assuming every health app handles PHI. A consumer app the user signs up for directly is often outside HIPAA."],["Calling data anonymous after removing names only. De-identification has specific methods in 164.514."]],"related":[{"href":"/glossary/baa","label":"BAA (business associate agreement)","detail":"The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."},{"href":"/glossary/human-in-the-loop","label":"Human-in-the-loop (HITL)","detail":"A design where a person reviews, corrects or approves what an AI system produces before it takes effect."},{"href":"/glossary/cardholder-data-environment","label":"Cardholder data environment (CDE)","detail":"The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."},{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"}],"sources":[{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"},{"title":"45 CFR 164.514, De-identification of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514","checkedAt":"2026-10-25"},{"title":"45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}