What counts as protected health information (PHI) under HIPAA?

Protected health information, or PHI, is individually identifiable health information that a HIPAA covered entity or its business associate creates, receives, keeps or sends. It covers records about a person's health, care or payment for care when the record identifies them. Strip the identifiers properly and it is no longer PHI.

What makes information identifiable?

The HIPAA Privacy Rule definitions in 45 CFR 160.103 build PHI in layers. Health information that is created or received by a provider, health plan, employer or clearinghouse and that relates to a person's past, present or future physical or mental health, to their care, or to payment for care becomes individually identifiable when it identifies the person, or when there is a reasonable basis to believe it can be used to identify them.

So a diagnosis alone is not PHI. A diagnosis in a record with a name, or with enough detail to point at one person, is. The second test, reasonable basis to identify, catches records with no name but rich detail.

Who has to protect it?

Covered entities are health plans, health care clearinghouses and providers that transmit certain transactions electronically. Business associates are the vendors that handle PHI on their behalf, such as a billing service or a cloud host. Whether a given service is a covered entity or a business associate depends on its facts, so confirm it for each one.

Electronic PHI, or ePHI, is the part held or sent in electronic form. The Security Rule applies to it, which is why storage, transport and access control questions land on engineering teams.

What are the 18 identifiers?

Under 45 CFR 164.514(b)(2), the Safe Harbor method of de-identification requires removing a list of identifiers of the individual and of their relatives, employers and household members. The list includes names, geographic subdivisions smaller than a state (with a limited exception for the first three digits of a zip code), all elements of dates except year that relate to the person, and ages over 89. It continues through telephone and fax numbers, email addresses, social security, medical record and account numbers, device identifiers, web URLs, IP addresses, biometric identifiers, full face photographs, and any other unique identifying number or code. The covered entity also must have no actual knowledge that what remains could identify someone.

Read the full text before relying on a summary. Small details such as the date rules and the zip code population threshold are where mistakes happen.

What is the other route to de-identification?

Expert determination. Under 164.514(b)(1), a person with appropriate knowledge of statistical and scientific methods determines that the risk is very small that the information could be used, alone or with other reasonably available information, to identify the individual, and documents the methods and results. This route suits datasets where Safe Harbor would strip out too much, such as detailed dates for a study of treatment timing.

A constructed example

A clinic exports appointment data for a no show analysis. The first draft keeps patient initials, full appointment dates and the five digit zip code, and it goes to a freelance analyst. That is still PHI. The clinic should either send it under a business associate agreement with proper safeguards, or de-identify it: drop initials, reduce dates to year, and truncate zip codes under the Safe Harbor rule. If the study needs dates, use the expert determination route instead.

Engineers see the same trap in logs, where the list's URLs and IP addresses turn up by default. A support ticket attachment, a debug log with a request body, or a test database copied from production can all hold PHI. Data that moves into those places outside your control plan is where breaches begin.

How to check or apply this

1. Map where health data enters, moves and rests: apps, databases, logs, backups, analytics and support tools.
2. Decide for each system whether you are a covered entity or a business associate, and confirm you have written agreements with each vendor that touches PHI.
3. Tag datasets that contain any of the identifiers, and keep test and analytics environments free of production PHI unless controls match.
4. Restrict access by role, record access, and encrypt in transit and at rest.
5. If you need to share data without PHI status, choose Safe Harbor or expert determination, and keep the documentation.
6. Have counsel confirm your reading of the rules. This article explains the text and is not legal advice.

Quick check

Sources

• 45 CFR 160.103, definitions (Legal Information Institute)
• 45 CFR 164.514, de-identification standard (Legal Information Institute)

Last reviewed: 18 October 2026.