What Is PHI in Medical Terms? Definition and Examples
Sam Ellis · October 6, 2026 · 17 min read · Published by Vero Scribe Inc.In U.S. medical privacy terminology, PHI means protected health information: individually identifiable information about a person’s health, healthcare or payment for care in the HIPAA-regulated setting. It can be electronic, paper or spoken. A diagnosis is not required. HHS Privacy Rule summary.
A clinic’s appointment list, a patient-linked bill and a consultation recording can all contain PHI. The practical question is not simply “Does this contain a name?” It is “What does this reveal about an identifiable person, who holds it, and for what purpose?”
In Ontario, PHI commonly means personal health information under the Personal Health Information Protection Act (PHIPA), rather than HIPAA’s U.S. term. The same acronym does not make the two legal frameworks interchangeable. IPC Ontario health privacy.
Sources checked October 6, 2026. Published by Vero, a healthcare documentation software provider.
What makes information PHI?
Start with the information, then establish the organization’s role. Under HIPAA, the underlying health information relates to past, present or future health, care provision or payment, and identifies a person or provides a reasonable basis for identification. The regulatory definition also contains exclusions. 45 CFR 160.103: definitions.
HIPAA applies to covered entities and business associates. Covered entities include health plans, healthcare clearinghouses and providers that conduct specified standard electronic transactions. A business associate performs certain functions or services involving PHI on their behalf. A medical-looking application is not automatically covered just because it stores health-related text. HHS covered-entity and business-associate guidance.
Three prompts make a useful first pass:
- Care context: does this concern someone’s health, receiving care or paying for it? Consider the appointment or bill as well as the clinical narrative.
- Identification: can a person be identified directly or through the available combination of details? Read record numbers, dates and attachment contents—not just the display name.
- Role and destination: who holds the information, in what capacity, and where is it going? A covered clinic’s record and an independent consumer app require different applicability analysis.
Check these three prompts against the regulatory definition and record missing facts explicitly. For example, “The supplier’s relationship to the clinic has not been established” identifies the next question to resolve.
Consider a scheduling export that contains only a medical record number, appointment date and clinic location. Staff can match that number to a person. The absence of a diagnosis or full name does not erase its care connection. Conversely, a public directory listing a physician’s work telephone number does not establish anything about a patient’s care.
Everyday PHI examples and context
These fictional U.S. examples show how the holder and purpose affect classification, following the HHS description of identifiable health information.
Scroll horizontally to compare the information, its context and the handling question.
| Information | Supplied context | Classification and next question |
|---|---|---|
| Appointment reminder | A covered clinic links a person to tomorrow’s consultation. | PHI: a care relationship is revealed. Is this recipient and communication channel approved? |
| Invoice | A covered practice bills an identifiable person for a service. | PHI: payment context matters. Does the recipient need the full attached clinical note? |
| Consultation audio | The clinic stores a recording linked to the encounter. | PHI/ePHI: inspect storage, access and extra copies, even before transcription. |
| Unsigned generated draft | A documentation tool holds a patient-linked care narrative for the clinic. | PHI/ePHI: “draft” does not mean unrestricted. Which workspace and recipients can access it? |
| Public staff directory | A physician’s name and business number appear without patient information. | Not PHI on these facts. Do not confuse staff identity with a patient-care record. |
| Employer absence file | A hospital holds a sick-leave record in its employer capacity. | HIPAA employment-record exclusion; other privacy duties may apply. Keep it separate from the employee’s patient chart. |
| Independent wellness app | A person enters health details; no covered-entity or business-associate relationship is established. | HIPAA applicability unresolved, not “public data.” Evaluate the app’s role and other applicable privacy rules. |
How the main exclusions work
The PHI definition excludes certain FERPA education and treatment records, employment records held in an employer role, and information about someone deceased for more than 50 years. Apply each exclusion to the record’s specific holder and purpose. 45 CFR 160.103: PHI exclusions.
For a hospital employee treated as a patient, compare two records: the employer’s leave file and the treating service’s patient chart. One institution can hold them in different capacities. The organization should identify the correct access route rather than merge the files because they concern the same person.
PHI, ePHI and PII are different terms
PHI is the health-privacy classification. ePHI is PHI maintained or transmitted electronically. PII, or personally identifiable information, is a broader identity-related term whose exact definition depends on the framework being used. Calling something PII does not establish whether HIPAA applies.
The HIPAA Security Rule addresses ePHI, while the Privacy Rule is not limited to electronic media. HHS describes administrative, physical and technical safeguards for electronic information. A spoken conversation and a stored recording therefore involve different security surfaces, even when they convey the same facts. HHS summary of the Security Rule currently in effect.
In a documentation workflow, map those surfaces separately: microphone capture, uploaded audio, transcript, generated draft, final EHR entry, export and support logs. A signature changes the record’s workflow status; it does not remove identifying health information from the earlier versions. The EHR introduction explains why those records and their destinations are not interchangeable.
Removing a name is not de-identification
HIPAA recognizes two de-identification routes. Safe Harbor requires removal of specified identifier categories and no actual knowledge that the remaining information could identify someone. Expert Determination uses a qualified expert’s documented assessment that identification risk is very small in the anticipated circumstances. The familiar “18 identifiers” refers to Safe Harbor categories—not 18 separate definitions of PHI. HHS de-identification guidance and official identifier list.
Safe Harbor: the 18 identifier categories
The removal requirement covers identifiers of the individual and their relatives, employers and household members. This compact reference follows 45 CFR 164.514(b)(2).
- Names
- Geography smaller than a state, including addresses and ZIP codes
- Individual-related dates and ages over 89, subject to the rules below
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers, including license plates
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers, including fingerprints and voiceprints
- Full-face photographs and comparable images
- Other unique identifying numbers, characteristics or codes
Four details are easy to miss:
- Dates: remove elements more precise than the year for dates directly related to the individual, including birth, admission, discharge and death—not just the visit date.
- Older ages: group ages over 89 as 90 or older. Remove date elements, including a birth year, that reveal such an age.
- Geography: a three-digit ZIP prefix can remain only when its combined geographic unit has more than 20,000 people, using current publicly available Census data. For units with 20,000 or fewer people, replace the prefix with 000. Other geography smaller than a state is removed.
- Free text: the same requirements apply to narrative and structured fields. Initials or the last four digits of a Social Security number are still derivatives of identifiers, not a shortcut around removal.
The final category has a narrow exception for a controlled re-identification code meeting section 164.514(c), not arbitrary pseudonyms. Removal of the categories is only one part of Safe Harbor: actual knowledge that the remaining information identifies a person, alone or combined with other information, prevents treating it as de-identified by this route. HHS practical de-identification guidance.
Suppose a screenshot hides a name but retains a medical record number, exact visit date and a narrative about a locally recognizable event. Name-only redaction has not established de-identification. The review must also cover free text, attachment names and visible surrounding material. HHS’s guidance expressly addresses identifiers in unstructured narrative, not just database columns.
Replacing a name with initials or an arbitrary label is not automatically sufficient either. A code that the recipient can readily connect to a person raises a different question from an approved, controlled re-identification mechanism. Do not infer a de-identification result from the appearance of a spreadsheet.
A limited data set is another distinct category: it remains PHI, removes specified direct identifiers, and has purpose and data-use-agreement conditions. It is not synonymous with de-identified information. 45 CFR 164.514(e): limited data sets.
For demonstrations, an entirely invented reproduction can be simpler than transforming a real encounter. A synthetic example uses newly created teaching or test content. De-identifying a real patient record is a separate process using Safe Harbor or Expert Determination.
Worked example: a software support packet
EX-PHI-01 is a fictional support scenario: two bullet items export as one paragraph. The clinic submits standard electronic claims, and its supplied policy permits only synthetic material in a public issue tracker. Compare how the policy treats each proposed packet.
The original proposal includes a patient-linked screenshot, visit date and consultation audio. Support needs to reproduce the formatting behavior, not understand the consultation. A second proposal hides only the name. A third rebuilds the problem in a new demo workspace with invented text and no production attachments.
Review the proposed support packet
EX-PHI-01 · fictional packet review
Compare three versions against the fixed scenario and supplied clinic policy.
Send the draft screenshot, MRN TEST-101, visit date and original consultation recording to the public issue tracker. The note is unsigned, so it is ready to share.
- Classification and policy finding
- In the represented real workflow, the MRN links the care narrative and audio to a person. An unsigned draft is still patient-linked information. Public sharing also conflicts with the supplied policy; signature status does not authorize it.
- Decision for this scenario
- Hold the packet. Reproduce the formatting problem with new synthetic content; keep the production screenshot and audio out of the public ticket.
Completed working record for the synthetic version
Record the finding and next action:
- Purpose: reproduce bullet formatting in an export.
- Data inspected: new demo note, screenshot edges, attachments and application/export settings.
- Finding: no actual individual’s information is supplied; the production screenshot and audio remain outside the public packet.
- Policy route: synthetic-only public support ticket; restricted production route still unapproved.
- Example outcome: send the checked synthetic reproduction. If it fails to reproduce the defect, ask the privacy owner to decide the separate restricted route.
This keeps the support task moving while preserving a visible unresolved decision. It also avoids a common failure: changing the label on a patient-linked attachment without changing its contents.
Recognizing PHI does not decide permission to share
PHI is not a blanket prohibition on communication. HIPAA permits some uses and disclosures without individual authorization, including many treatment, payment and healthcare-operations activities under their applicable conditions. Other purposes can require authorization or another specific basis. HHS Privacy Rule permissions. The HIPAA authorization checklist covers that separate decision.
The minimum necessary standard generally calls for reasonable limits appropriate to the intended purpose. It has exceptions, including disclosures to, or requests by, healthcare providers for treatment. That exception is not a blanket permission for every staff member to browse every chart. HHS also describes role-based internal access policies. HHS minimum necessary guidance and exceptions.
For each request, write down the purpose, recipient, information needed and approved route. “Billing question” and “clinical handoff” should not silently receive the same attachments. Likewise, a patient’s request for their own record differs from a third party’s request. The medical release guide follows those request and delivery distinctions.
PHI in cloud software and AI documentation
Encryption protects information; it does not turn PHI into non-PHI. HHS explains that a cloud provider maintaining encrypted ePHI for a covered entity or business associate can be a business associate even without the decryption key. OCR does not certify or endorse particular cloud products. HHS cloud-computing guidance.
A business associate agreement sets out the relationship and obligations. Review it alongside the configured data flow and controls: which service and plan it covers, where information is stored, who can access it, how subcontractors are involved, and what happens to exports, backups and account closure.
For AI documentation, map where raw inputs and drafts go besides the final note. Check whether support attachments, analytics events or error reports carry encounter details. Compare the “delete note” control with retained copies and applicable retention obligations. Use these questions to review supplier documentation and the configured workflow. The medical records software guide develops export, amendment and exit-access tests.
Outside HIPAA does not mean unprotected
Certain personal-health-record vendors, related entities and service providers outside HIPAA fall under the FTC Health Breach Notification Rule. FTC guidance addresses health apps and connected devices and explains that unauthorized disclosures can matter, not only hacking. Applicability depends on the business and data arrangement; it is not automatic for every app. FTC compliance guidance.
For a consumer app, identify who operates it and whether it acts for a healthcare organization or directly for the user. Establish the applicable privacy obligations before deciding how information can be used or shared.
Canada uses different privacy frameworks
Ontario’s PHIPA governs collection, use and disclosure of personal health information in the health sector. The IPC explains its dual aim of protecting confidentiality and supporting healthcare delivery. A Canadian clinic should identify its applicable custodian and service-provider obligations instead of treating a U.S. HIPAA label as a Canadian approval. IPC Ontario guidance.
Under PIPEDA, personal information includes recorded or unrecorded information about an identifiable individual, including medical records. Its coverage depends on the activity and organization. The OPC notes that hospitals and other public institutions are generally governed by provincial laws, with PIPEDA relevant in some situations. OPC PIPEDA requirements.
Substantially similar provincial private-sector or health-information laws can displace PIPEDA for covered activities within a province. Commercial cross-border information flows may still engage PIPEDA, and more than one law can apply to different activities. OPC provincial-law and cross-border explanation.
For a software contract, record the clinic’s province, organizational role, purpose and actual data destinations. Assess storage location alongside access, permitted uses, retention and incident responsibilities. Establish Canadian de-identification or disclosure permission under the applicable Canadian framework rather than HIPAA’s Safe Harbor identifier list.
A practical PHI handling checklist
Use Vero’s editorial checklist to collect evidence for the responsible privacy team. Each step applies the source distinctions above to a specific packet and destination.
- State the context. Identify jurisdiction, organization and whether the record is held for care, employment or another purpose. Reference the applicable definition.
- Inspect the complete packet. Include narrative, headers, files, screenshots, audio and linked identifiers—not just the visible field being edited.
- Separate classification from permission. Record the intended recipient and purpose, then identify the applicable authority or route requiring approval.
- Choose the appropriate content. Consider a new synthetic reproduction for a demonstration; for an actual record request, preserve the authorized scope rather than substituting invented content.
- Verify the destination. Check the account, recipient, channel, attachment version and access settings before release. Keep confidential decision evidence in the approved internal workspace.
- Retain the decision. Record who made it, when, what facts and rules supported it, what was sent, and any outstanding approval. An unchecked question remains unresolved.
If information reaches the wrong place
Follow the local incident procedure promptly, stop further sharing, and preserve relevant evidence for the privacy/security team. Include recall attempts and recipient assurances in the mitigation record and notification assessment. HHS describes the breach framework, exceptions and documented risk assessment for impermissible uses or disclosures. HHS breach-notification guidance.
Report the event through the designated route and preserve the audit trail. The responsible team determines the applicable framework, containment, assessment and notifications. Identify the information first, then make and document the authorized decision.
Sources and further reading
Sources checked October 6, 2026. The linked materials support the U.S. and Canadian definitions and workflows. Specialist review: pending.
Questions about PHI in medical terms
U.S. and Canadian distinctions; legal sources checked October 6, 2026.
What is PHI in medical terms?
In U.S. HIPAA usage, PHI means protected health information. It combines identifiable information with a person’s health, care or payment context in the regulated setting. The definition is broader than a diagnosis and includes information in paper, electronic and spoken forms.
Is a name alone PHI?
Not automatically. A public staff-directory name has no patient-care context. The same name connected to an appointment or medical bill in a covered clinic’s records can be PHI. Review what the information reveals, not the identifier alone.
Can an appointment reminder be PHI without a diagnosis?
Yes. A covered clinic’s reminder can identify a person and reveal the provision of care. A diagnosis is unnecessary for that connection. Check the recipient, approved communication route and message content before sending.
What is the difference between PHI and ePHI?
ePHI is the electronic subset of PHI. Paper and spoken PHI remain within the Privacy Rule; the HIPAA Security Rule addresses electronic PHI. An electronic recording, attachment or stored draft can therefore require security controls even before it becomes a finalized note.
Is an unsigned AI-generated note PHI?
It can be. A patient-linked draft containing health information does not become non-PHI because it is unsigned, inaccurate or awaiting review. Track the input, draft, saved copies and logs as separate data locations.
Does removing the name de-identify a medical record?
No. Dates, record numbers and other details may remain identifying. HIPAA recognizes Safe Harbor and Expert Determination routes; name removal alone establishes neither. Review identifiers in narrative text as well as labeled fields.
Show all questions
Is a limited data set the same as de-identified data?
No. A HIPAA limited data set remains PHI. Its permitted purposes and data-use-agreement requirements differ from properly de-identified information. A file retaining dates should not be described as anonymous solely because direct names were removed.
Does encryption stop information being PHI?
No. Encryption protects information; it does not change its classification. HHS explains that a cloud provider maintaining encrypted ePHI for a covered entity or business associate can itself be a business associate without holding the decryption key.
Are hospital employee records always PHI?
No. HIPAA excludes employment records a covered entity holds in its employer role. An employee’s patient chart held for treatment is a different record in a different capacity. Other privacy obligations may still apply to the employment file.
Does HIPAA protect information after a person dies?
Generally, identifiable health information remains protected for 50 years after death. The PHI definition excludes information about a person deceased for more than 50 years. Other applicable laws and records obligations can still matter.
Is every health app covered by HIPAA?
No. Coverage depends on the organization’s role and relationships. Certain non-HIPAA personal-health-record businesses fall under the FTC Health Breach Notification Rule. Outside HIPAA does not mean outside privacy protection.
Does PHI mean the same thing in Canada?
Not necessarily. Ontario uses personal health information under PHIPA; HIPAA uses protected health information in the United States. Canada’s applicable privacy law depends on the province, organization, activity and data flow. Use that framework to establish the disclosure and de-identification requirements.
Does the minimum necessary rule always limit treatment disclosures?
No. HHS identifies an exception for disclosures to, or requests by, a healthcare provider for treatment. That exception is not unrestricted staff access. Organizational access policies and other applicable requirements still need to be considered.
What should staff do after sending PHI to the wrong recipient?
Promptly follow the organization’s incident process, stop further sharing and preserve relevant evidence in the approved workspace. The responsible privacy team evaluates the disclosure, mitigation and notification duties, including recall attempts and recipient assurances.
