PHI (protected health information)
Also called protected health information, ePHI.
Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
Last updated
What it is.
HIPAA defines PHI in 45 CFR 160.103 as individually identifiable health information, in any form, held or sent by a covered entity (a health plan, a healthcare clearinghouse, or a provider that bills electronically) or by its business associate. It covers a person's health, the care they receive and payment for that care, when it is linked to something that identifies them, such as a name, dates, contact details or a record number.
PHI stored or sent electronically is often called ePHI, and the HIPAA Security Rule sets the safeguards for it. Data that has been properly de-identified under 45 CFR 164.514 is no longer PHI. Some records are excluded, such as employment records a covered entity holds as an employer.
Why it matters
Whether your software handles PHI decides whether HIPAA applies to you at all. If it does, you need a BAA with each covered entity customer, Security Rule safeguards such as access control, audit logs and encryption, and a breach process. If it does not, other rules may still apply.
Common mistakes.
- 01
Thinking only diagnoses count. An appointment linked to a name can be PHI.
- 02
Assuming every health app handles PHI. A consumer app the user signs up for directly is often outside HIPAA.
- 03
Calling data anonymous after removing names only. De-identification has specific methods in 164.514.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
- 45 CFR 164.514, De-identification of PHI (eCFR)checked 2026-10-25
- 45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- BAA (business associate agreement)The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
- Human-in-the-loop (HITL)A design where a person reviews, corrects or approves what an AI system produces before it takes effect.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
