What is PHI (protected health information)?
Protected health information is individually identifiable health information held or transmitted by a HIPAA covered entity or its business associate: details about a person’s health, care or payment for care that can be linked to them.
Protected health information examples
- A patient’s diagnosis together with their name.
- Appointment dates linked to a medical record number.
- A billing record showing treatment and payment details.
- Lab results stored with an email address.
The 18 HIPAA identifiers
HIPAA’s Safe Harbor method lists 18 identifiers that must be removed before health information counts as de-identified. They include names, geographic details smaller than a state, all elements of dates except the year, phone and fax numbers, email addresses, Social Security numbers, medical record and health plan numbers, account numbers, licence and vehicle numbers, device identifiers, web addresses, IP addresses, biometric identifiers, full-face photos and any other unique identifying code.
Is an email address PHI?
On its own, no. It becomes PHI when a covered entity or business associate holds it together with health information, for example on a clinic’s appointment reminder list. Context decides: the same address on a newsletter list is not PHI.
PHI vs PII
Personally identifiable information is any information that identifies a person. PHI is the narrower set that ties identity to health information and is held by an organisation HIPAA covers. All PHI is PII; most PII is not PHI.
What is ePHI?
Electronic protected health information is PHI created, stored or sent electronically. The HIPAA Security Rule applies to ePHI and requires administrative, physical and technical safeguards, which is where most of a software company’s HIPAA controls come from. Compliance as a Service for SMBs tracks those controls in its HIPAA library.
Last reviewed 2026-11-01.