What Is Protected Health Information (PHI) Under HIPAA?

Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate in any form, whether electronic, paper, or oral. It excludes certain education records, employment records held by a covered entity in its role as employer, and information about a person deceased more than 50 years.

Definition. 45 CFR 160.103 defines health information as information that relates to an individual's past, present, or future physical or mental health or condition, the provision of health care, or payment for health care. It is individually identifiable when it identifies the individual or there is a reasonable basis to believe it can be used to identify the individual. Demographic identifiers can be PHI when associated with information about health, health care or payment; a name or address alone is not necessarily PHI.

Electronic PHI. Electronic protected health information (ePHI) is PHI that is transmitted by or maintained in electronic media. The Security Rule (45 CFR Part 164, Subpart C) applies to ePHI, while the Privacy Rule applies to PHI in every form.

Exclusions. The definition excludes education records covered by FERPA and the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), employment records held by a covered entity in its role as employer, and information about a person who has been deceased for more than 50 years.

Health information at a school is not automatically excluded; the exclusion depends on whether the records fall within those FERPA categories.

De-identified information. Health information that meets the de-identification standard in 45 CFR 164.514 is not PHI.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."