Protected health information (PHI) is health information that identifies, or could reasonably identify, an individual and is held by a HIPAA-covered entity or business associate. This guide sets out the two-part test for PHI, the 18 HIPAA identifiers, common and less obvious examples, the principal exclusions, and the workforce risks that most frequently lead to PHI exposure.

Healthcare organizations and their business associates make a high volume of routine decisions about patient data, including whether to attach a file to an email, which fax number to use, what content to publish in marketing materials, and which analytics scripts to deploy on a website. Each of these decisions depends on an accurate answer to a single question: does the information constitute PHI? Incorrect classification results in breach notifications, regulatory investigations, and erosion of patient trust.

The scale of the issue is significant. HIPAA-regulated organizations reported 772 large data breaches in 2025, a new annual record, exposing the health information of approximately 138.5 million individuals. Between 2009 and 2025, large healthcare breaches affected more than one billion records. This guide defines PHI, clarifies where its boundaries lie, and examines the role of human behavior in determining whether PHI remains protected.

What does PHI stand for?

PHI stands for protected health information, the individually identifiable health information that HIPAA regulates when it is held by a covered entity or business associate. The formal definition sits in the HIPAA regulations at 45 CFR 160.103, and it covers information in any form or medium: electronic, paper, or spoken.

To qualify as PHI, the information must relate to at least one of the following:

• An individual's past, present, or future physical or mental health or condition.
• The provision of health care to that individual.
• The past, present, or future payment for that individual's health care.

Two categories of organizations are obligated to protect PHI. Covered entities are health plans, health care clearinghouses, and health care providers that conduct standard transactions electronically, such as billing a health plan. Business associates are vendors and partners that create, receive, maintain, or transmit PHI on a covered entity's behalf, including billing companies, IT and managed service providers, cloud hosting providers, transcription services, and consultants.

Business associates represent a material share of healthcare data risk. In 2025, the largest healthcare breach of the year occurred at a business associate, Conduent Business Services, affecting more than 62 million individuals and ranking as the third-largest healthcare data breach on record. Any organization that handles PHI on behalf of a healthcare client is subject to the definitions set out in this guide.

The two-part test: health information plus an identifier

Information constitutes PHI when it satisfies both parts of a two-part test: it is health information, and it identifies the individual or provides a reasonable basis for identification. Information that fails either part is not PHI. Both parts are subject to a context condition: the information must be held by a covered entity or by a business associate acting on its behalf.

• Part 1: Is it health information? The scope of health information extends well beyond the clinical record. It encompasses any information that reveals a condition, the care an individual received, or the payment for that care. An appointment time at an oncology clinic constitutes health information because it discloses a care relationship. The same principle applies to a claim number, a pharmacy pickup record, or a note recording a missed physical therapy session.
  
  
• Part 2: Does it identify the individual? Identifiability is not limited to names. HIPAA treats information as identifiable when it identifies the individual directly or when there is a reasonable basis to believe it could be used to identify the individual. Limited combinations of data points are frequently sufficient: a rare diagnosis, a small municipality, and an exact admission date may together identify a single individual without any name present.
  
  

• The 18 HIPAA identifiers
  The 18 HIPAA identifiers are the data elements that must be removed for health information to be considered deidentified under the Safe Harbor method at 45 CFR 164.514(b)(2). The list serves as a practical reference for recognizing identifiable data; however, it is not an exhaustive definition of PHI. Where any other detail could reasonably identify the individual, the information remains PHI.

Two provisions warrant particular attention. First, every element of a date other than the year is an identifier; a discharge date of March 14 is therefore identifying even in the absence of a name. Second, the list includes digital identifiers such as IP addresses, URLs, and device serial numbers, which accounts for the increasing prevalence of website analytics and connected medical devices in breach reports.

Common examples of PHI

The most common examples of PHI are records that combine a patient's identity with their care or payment details: medical charts, lab results, prescriptions, claims, appointment schedules, and billing statements. The following table presents typical examples and the basis on which each satisfies the two-part test.

Clinical teams generally recognize these examples of PHI. The more challenging cases involve information that does not resemble a medical record, and these cases account for a substantial share of avoidable exposures.

Less obvious PHI

Less obvious PHI includes any identifiable detail that reveals a care relationship, even when no diagnosis is present: a photo in a patient success story, a voicemail reminder, an email address on a clinic mailing list, or browsing data sent to an advertising platform from a patient portal. These categories receive limited attention in onboarding training, yet they feature regularly in enforcement actions.

• Marketing stories and social media posts: A patient photograph accompanied by a first name and a recovery narrative constitutes PHI when it derives from a provider's records. In September 2025, the HHS Office for Civil Rights (OCR) announced a $182,000 settlement with Cadia Healthcare Facilities, a group of Delaware rehabilitation and skilled nursing providers. OCR found that the organization had published the names, photographs, and treatment details of 150 patients through a "success story" program without valid written authorizations. Although the organization maintained a consent policy, the failure occurred at the point at which an employee approved content for publication.
  
  
• Website tracking and analytics data: Analytics scripts can convert routine web traffic into PHI. In April 2025, Blue Shield of California notified 4.7 million members that a Google Analytics configuration had shared member data with Google Ads between April 2021 and January 2024. The shared data reportedly included plan details, demographic information, and "Find a Doctor" search criteria and results. No threat actor was involved; a configuration decision resulted in the disclosure of PHI at scale for nearly three years. The regulatory position requires careful interpretation. A 2024 federal court ruling vacated part of HHS guidance on tracking technologies for public, unauthenticated web pages. Tracking on authenticated pages, such as patient portals and scheduling tools, remains a well-established PHI risk.
  
  
• Voicemails, reminders, and mailing lists: A voicemail saying "This is the fertility clinic confirming your appointment on Thursday" contains PHI: an identifiable individual, a specialty, and a date. A provider's email list of patients is PHI because inclusion on the list implies a care relationship, even where the communications themselves are general newsletters.
  
  
• Information inside email inboxes: Email is one of the largest repositories of unmanaged PHI. In 2025, 24.9% of large healthcare data breaches involved compromised email accounts. Patient list spreadsheets, forwarded lab results, and scanned referral forms frequently accumulate in mailboxes over several years. Consequently, a single compromised account may expose considerably more PHI than its owner anticipates.
  
  
• Data pasted into AI tools: When an employee enters a clinical note into a public generative AI tool for summarization, the note is disclosed to the tool's vendor. In the absence of a business associate agreement and a permitted purpose, such a disclosure is likely to be impermissible. This represents a rapidly expanding risk area that is driven entirely by workforce behavior.
  
  
• Conversations: PHI is not limited to written or recorded information. A discussion about a named patient in an elevator, in a waiting room, or on a speakerphone call in an open office is a disclosure of PHI under the Privacy Rule.

What is not PHI?

Information is not PHI when it fails either part of the two-part test, or when it falls outside the context condition or a specific regulatory exclusion. The most common categories of what is not PHI are deidentified data, employment records, education records, consumer health data held outside HIPAA, and records of individuals who died more than 50 years ago.

• Deidentified health information: Health information that has been properly deidentified is not PHI. HIPAA recognizes two methods: Safe Harbor, which removes all 18 identifiers and requires that the organization has no actual knowledge the remaining data could identify anyone, and Expert Determination, in which a qualified statistician documents that the risk of reidentification is very small. Note that a limited data set, which keeps some dates and geographic details, is still PHI and can only be shared under a data use agreement.
  
  
• Employment records held by a covered entity as an employer: A hospital's HR file containing a doctor's note for an employee's sick leave is not PHI, because the hospital holds it as an employer, not as a provider. The same employee's chart from a visit to that hospital's emergency department is PHI. The underlying data may be identical; the capacity in which the organization holds it determines its status.
  
  
• Education records covered by FERPA: Health records maintained by a school, such as a school nurse's records for students, are generally education records under the Family Educational Rights and Privacy Act (FERPA) and are excluded from the HIPAA definition of PHI.
  
  
• Consumer health data outside HIPAA: Heart rate data in a fitness tracker, symptoms logged in a period tracking app, or a direct-to-consumer wellness quiz are not PHI when the company collects them for its own consumer service rather than on behalf of a covered entity. Such data is not, however, unregulated. The FTC's Health Breach Notification Rule and state laws such as Washington's My Health My Data Act apply to many of these products.
  
  
• Records of individuals deceased for more than 50 years: Health information stops being PHI 50 years after the individual's death. Until that point, it remains fully protected.
  
  
• Information with no health connection: A name and email address on a general newsletter list held by a company that is not a covered entity is personal data, not PHI. It is the connection to care that determines PHI status.

PHI vs ePHI

ePHI is electronic protected health information: any PHI that is created, received, maintained, or transmitted in electronic form. All ePHI is PHI, but not all PHI is ePHI. The distinction matters because it determines which HIPAA rules apply and which safeguards an organization must be able to evidence.

The Privacy Rule governs how all PHI may be used and disclosed, regardless of format. The Security Rule applies only to ePHI and requires administrative safeguards (such as risk analysis and workforce security awareness training), physical safeguards (such as facility and workstation controls), and technical safeguards (such as access controls, audit logs, and transmission security).

The Security Rule is also the focus of current regulatory change. HHS published a proposed overhaul in January 2025 that would, among other changes, make encryption of ePHI and multifactor authentication required rather than addressable. At the time of writing, the update remains a proposed rule and its earlier target date has passed. OCR's current enforcement priorities are well defined: in 2025, 76% of OCR enforcement actions included a penalty for a risk analysis failure, and OCR has said its 2026 initiative is expanding to cover risk management as well.

Why PHI exposure is a human risk problem

Most PHI exposure originates with a human decision, such as responding to a phishing email, misdirecting a fax, uploading data to an unapproved service, or publishing content without authorization. An accurate definition of PHI addresses only part of the challenge. Organizations must also understand which members of the workforce handle PHI, how those individuals behave, and where their risk signals converge.

Unauthorized access and disclosure incidents, the category that includes employee errors, snooping, and insider data theft, rose 17.4% in 2025 even as other breach categories declined. Data on the location of breached PHI further illustrates where human behavior and technical exposure intersect.

When PHI access meets risky behavior: toxic combinations

Individual risk signals, assessed in isolation, provide an incomplete picture. A billing coordinator who occasionally fails phishing simulations represents a moderate risk. The same coordinator, whose mailbox contains several years of patient spreadsheets, whose email account lacks multifactor authentication, whose HIPAA training is overdue, and whose password appears in a breach database, represents a substantially greater risk. This convergence is described as a toxic combination: multiple weaknesses that reinforce one another around a single identity with access to PHI.

Recent incidents demonstrate how long a compromised mailbox containing PHI can remain undetected. In 2026, Heart Care Centers of Illinois disclosed that a phishing attack gave an intruder access to an employee's email account for about 76 days in 2024. The practice identified the compromise only in January 2026, during the investigation of a separate phishing attempt. Reducing the interval between compromise and detection is a central objective of a unified view of human risk.

A Human Risk Intelligence approach consolidates these signals, including phishing simulation results, training completion, policy acknowledgments, identity hygiene, and dark web exposure, and correlates them at the individual level. In the context of PHI, this enables organizations to answer the questions OCR increasingly raises following a breach: which workforce members had access, what risk profile each presented, and what remedial action was taken.

Further guidance on workforce training obligations is available in the guide to HIPAA training requirements, and related resources are available in the HIPAA compliance hub.

Defining PHI and managing the human risk around it

PHI is health information plus an identifier, held by a covered entity or business associate. The 18 HIPAA identifiers provide a reference for recognizing identifiable data, deidentified data and excluded records fall outside the definition, and ePHI is subject to the Security Rule's safeguards in addition to the Privacy Rule.

The definition, however, represents only the starting point. The record 772 large healthcare breaches reported in 2025, the increase in unauthorized access and disclosure incidents, and enforcement cases such as Cadia Healthcare and the Blue Shield of California disclosure point to a consistent conclusion: PHI is compromised far more frequently through routine human decisions than through ambiguity in the definition. Organizations that combine a precise understanding of PHI with real-time visibility into the human risk associated with each individual who handles it are best positioned to protect patients and to demonstrate due diligence to regulators.

FAQs

• Is a patient's name on its own PHI?
  A name alone is not PHI. It becomes PHI when a covered entity or business associate holds it in connection with health information, such as an appointment list, a claim, or a patient roster, because its presence in that record reveals a care relationship.
  
  
• Does PHI include information that is spoken aloud?
  Yes. PHI covers health information in any form, including oral, paper, and electronic. A conversation about a patient overheard in a waiting room is still PHI, which is why the Privacy Rule applies to spoken disclosures as well as records.
  
  
• How long does health information remain PHI after a person dies?
  Health information remains PHI for 50 years after the individual's death. After that point, it falls outside the HIPAA definition of protected health information.
  
  
• Is it a HIPAA violation to paste PHI into a generative AI tool?
  Entering PHI into an AI tool is a disclosure to the vendor that operates it. Unless the organization has a business associate agreement with that vendor and the use is otherwise permitted, it is likely an impermissible disclosure. Clearly defined acceptable use policies and targeted training mitigate this risk.
  
  
• Is a limited data set still PHI?
  Yes. A limited data set removes direct identifiers but may retain dates, city, state, and ZIP code. It remains PHI and may only be shared for research, public health, or health care operations under a data use agreement.

‍