Protected Health Information (PHI)

Protected Health Information, or PHI as it’s known in the health care industry, is any health information that can be tied to you as an individual.

For a piece of information to qualify as PHI, it must:

• Relate to your physical or mental health condition, your health care activity, or health care payments
• Identify you directly, or be used to identify you, as an individual

Identifying information includes things like:

• Your name, address, and zipcode
• Your birthday or admission/discharge dates
• Your phone/fax number or email
• Your social security number, medical record number, account number, license number, vehicle identifiers, and device identification numbers
• URLs or IP addresses
• Photos, videos, and biometric identifiers like finger or voice prints

Without written authorization from you, your PHI can only be accessed for your treatment, health care payments, or health care operations. If you want to give a family member or close friend access to your PHI, you’ll have to fill out a HIPAA authorization form (opens in new tab) to be able to speak with your doctors or insurance company on your behalf.

If your health information is de-identified – meaning it doesn’t directly or indirectly identify you as an individual in any way – it’s no longer considered PHI. This health information can be shared and used more broadly for research and reporting purposes.