Protected Health Information (PHI)

What Is Protected Health Information?

Protected health information (PHI) is individually identifiable health information protected by HIPAA when it is created, received, maintained, or transmitted by a covered entity or business associate. It can exist in electronic, paper, or oral form.

PHI matters financially because health information is tied to insurance claims, billing, benefits, care decisions, identity risk, and employer-sponsored health plans. A privacy failure can harm patients and create legal, operational, and reputational costs for organizations.

How PHI Works

Health information becomes PHI when it identifies or can reasonably identify an individual and is handled by an organization subject to HIPAA. Examples can include diagnoses, treatment information, claims, account numbers, dates of service, medical record numbers, and billing details tied to a person.

Covered entities include many health plans, health care clearinghouses, and health care providers that conduct certain electronic transactions. Business associates are vendors or partners that create, receive, maintain, or transmit PHI for covered functions.

Financial And Insurance Context

PHI is not just clinical information. It can appear in health insurance enrollment, explanations of benefits, claims processing, flexible spending account substantiation, wellness program administration, and employer health plan operations. That is why finance, HR, benefits, and compliance teams may encounter PHI even outside a hospital setting.

When PHI is mishandled, the financial consequences can include breach notification costs, investigation expense, system remediation, regulatory penalties, contract disputes, and loss of customer trust.

What PHI Is Not

Not all health-related data is PHI. A step count in a consumer fitness app may not be PHI if the app is not acting for a HIPAA covered entity or business associate. The same type of information could become PHI in a covered clinical or plan context.

This distinction is important because people often use PHI as shorthand for all sensitive health data. HIPAA’s legal definition is narrower than the everyday privacy concern.

Example

A hospital bill with a patient’s name, diagnosis code, date of service, and insurer information is PHI when handled by a covered hospital or its billing vendor. The same diagnosis discussed anonymously in a public health article is not PHI if it cannot identify an individual and is not tied to a covered entity’s records.

Employers should be especially careful around health plan information. A company may sponsor a group health plan, but managers should not casually access claims data about employees. Plan administration requires separation, minimum-necessary practices, and appropriate controls.

PHI And Cybersecurity

Electronic PHI is a major cybersecurity concern because it combines identity data, health data, and payment information. A breach can expose medical history and financial identifiers at the same time. That is why HIPAA privacy and security controls often sit beside broader cyber insurance, vendor management, and incident response planning.

PHI controls also affect mergers, audits, and vendor contracts. A buyer or partner may need to understand whether health data was handled under HIPAA-compliant agreements and safeguards.

Individuals should also know that HIPAA rights are not the same as ownership of every medical record. The rules focus on permissible use, disclosure, access, amendment, safeguards, and accountability within covered relationships.

The Bottom Line

Protected health information is identifiable health information protected by HIPAA in covered contexts. It matters because health data connects care, insurance, billing, identity, and organizational risk.