PHI (protected health information)
Protected health information (PHI) is individually identifiable health information held or transmitted by a HIPAA covered entity or business associate, in any form or medium, electronic, paper or spoken.
Also called protected health information, ePHI
- Last reviewed
- 2 sources, linked
- 5 related terms
What it means
Health information becomes PHI when it relates to a person's health, care or payment for care and either identifies them or gives a reasonable basis to identify them. A name next to an insurance plan and a request for detox is PHI in a treatment center's hands.
HIPAA's safe-harbor method for de-identifying data lists 18 identifiers that must be removed. Names, phone numbers, email addresses and full-face photographs are on it, and so are web addresses (URLs) and IP addresses, which is why website data can turn into PHI faster than people expect.
Some information is excluded, including employment records a covered entity holds in its role as an employer and information about a person who has been dead for more than 50 years.
Why it matters for your website
Assume anything a visitor types into a treatment center's form is PHI: name, phone, insurer, member ID, the reason for calling. The same goes for call recordings and chat transcripts. Map where each of those goes before launch, not after a vendor's tag has started sending it somewhere.
Keep PHI out of places it does not belong: page URLs and query strings, analytics events, email subject lines and advertising audiences.
Sources
The facts on this page about a law, a regulator, a clinical standard or a platform come from these sources. Each link opens the original in a new tab.
- Cornell Law School, Legal Information Institute45 CFR § 160.103, Definitions (covered entity, business associate, protected health information) (opens in a new tab)
- Cornell Law School, Legal Information Institute45 CFR § 164.514(b), De-identification safe harbor identifiers (opens in a new tab)
Last reviewed
This entry explains a rule so you can plan a website around it. It is not legal advice: for a decision about your own program, ask a healthcare attorney.
See how your own site handles it
Send your URL for the free funnel review. Within two business days you get a 3-minute video on the page your traffic lands on, the three places it is losing inquiries, and what ChatGPT and Perplexity say about your center. It is free, and no call is attached.