A Single Fax Changed Everything for This Clinic

A dermatology practice in New England lost $150,000 in a settlement with the Office for Civil Rights — not because of a cyberattack, not because of a disgruntled employee, but because a staff member faxed a patient's lab results to the wrong number. The person who received that fax filed a complaint. OCR investigated. And when investigators arrived, they discovered the clinic had never trained its workforce on what qualifies as Protected Health Information.

That story captures why this three-letter acronym matters more than most people realize. PHI stands for Protected Health Information, and it's the single most important concept in HIPAA compliance. If your team doesn't understand what PHI is, they can't protect it. And if they can't protect it, your organization is one misdirected fax, one lost laptop, one careless conversation away from an enforcement action.

This post will break down exactly what PHI includes, what makes it "protected," and the mistakes I see organizations make year after year.

PHI Stands For Protected Health Information — Here's the Full Definition

Under the HIPAA Privacy Rule, PHI stands for Protected Health Information. It refers to any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or its business associates. That definition comes directly from HHS's Privacy Rule guidance.

Let's unpack that. "Individually identifiable" means the information either directly identifies a person — like a name or Social Security number — or contains enough detail that someone could reasonably use it to identify that person. "Health information" means it relates to a person's past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare.

Combine those two elements, and you have PHI.

The 18 Identifiers That Make Health Data "Protected"

HHS specifies 18 types of identifiers. When any one of these is linked to health information, you're dealing with PHI:

  • Names
  • Geographic data smaller than a state
  • Dates (except year) related to an individual — birth date, admission date, discharge date, date of death
  • Phone numbers
  • Fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Vehicle identifiers and serial numbers
  • Device identifiers and serial numbers
  • Web URLs
  • IP addresses
  • Biometric identifiers (fingerprints, voiceprints)
  • Full-face photographs and comparable images
  • Any other unique identifying number, characteristic, or code

Strip all 18 identifiers, and you have de-identified data. Keep even one attached to a health record, and it's PHI. The distinction is black and white.

What About ePHI? The Digital Layer Most Teams Overlook

When PHI exists in electronic form — stored on a server, transmitted via email, sitting in a cloud-based EHR — it becomes ePHI, or electronic Protected Health Information. The HIPAA Security Rule applies specifically to ePHI and requires covered entities and business associates to implement administrative, physical, and technical safeguards.

I've seen organizations assume that "PHI" only means paper records. That assumption is dangerously wrong. In 2026, the vast majority of PHI your organization handles is electronic. Every patient portal message, every e-prescription, every digital image in your radiology system — that's ePHI.

The Security Rule demands risk assessments, access controls, audit logs, encryption standards, and more. If you're not treating ePHI with the same seriousness as a paper chart locked in a filing cabinet, you're exposed. And OCR knows it.

The $4.3 Million Mistake: What Happens When PHI Isn't Protected

In 2019, the University of Texas MD Anderson Cancer Center lost its appeal of a $4.3 million penalty imposed by HHS. The violations involved unencrypted ePHI on stolen laptops and a lost thumb drive. The data included patient names, treatment information, and medical record numbers — textbook PHI.

MD Anderson argued the devices were password-protected. The administrative law judge was unmoved. Passwords aren't encryption. The organization knew it had ePHI on portable devices and failed to encrypt them. That failure turned a theft into a HIPAA violation with a multi-million-dollar price tag.

This case is a masterclass in why understanding what PHI stands for — and where it lives — is foundational to compliance.

Who Needs to Understand PHI? Everyone in Your Workforce

HIPAA doesn't limit the PHI protection requirement to doctors and nurses. The Privacy Rule defines "workforce" broadly: employees, volunteers, trainees, and anyone under an organization's direct control. Your front desk staff handles PHI every time they pull up a patient record. Your billing team swims in it daily. Even your IT department, which may never interact with a patient, touches ePHI constantly.

This is where workforce training becomes non-negotiable. The HIPAA Privacy Rule at 45 CFR Part 164, Subpart E requires covered entities to train all workforce members on policies and procedures related to PHI. Not just clinicians. Not just managers. Everyone.

If your organization hasn't completed its annual training cycle yet, our HIPAA Introduction Training 2026 course walks your entire team through PHI definitions, real-world scenarios, and the safeguards they're responsible for implementing.

Common PHI Mistakes I See Every Month

1. Discussing Patients in Public Areas

Elevator conversations, cafeteria chatter, hallway consults within earshot of visitors — these happen constantly. Every time a staff member mentions a patient's name alongside a diagnosis or treatment detail in a public space, PHI has been disclosed. The Privacy Rule requires "reasonable safeguards" to prevent incidental disclosures. Whispering doesn't count.

2. Sending PHI to Personal Email Accounts

A physician wants to review charts at home and forwards records to a Gmail account. That ePHI just left your organization's secured environment. No encryption, no access controls, no audit trail. I've seen this trigger OCR investigations more than once.

3. Leaving PHI on Screens

Workstations left unlocked with patient records visible. Check-in sheets with patient names and appointment reasons on a clipboard at reception. These are classic, preventable exposures.

4. Improper Disposal

Throwing paper records with patient information into a standard trash bin instead of a shredding bin. Donating old computers without wiping the hard drives. Both are PHI breaches waiting to happen.

PHI vs. Health Information: What's the Actual Difference?

Not all health information is PHI. If a hospital publishes aggregate flu statistics — "423 flu cases treated in January" — that's health information, but it's not PHI because it doesn't identify any individual. A medical textbook describing symptoms of diabetes contains health information. It's not PHI.

PHI only exists when health information is linked to an identifiable individual and is held or transmitted by a covered entity or business associate. A person's Fitbit data, for example, generally isn't PHI under HIPAA because consumer app companies typically aren't covered entities. Context determines everything.

Does PHI Include Deceased Individuals?

Yes. HIPAA protections apply to the PHI of deceased individuals for 50 years following the date of death. I've seen organizations assume that once a patient dies, their records lose protection. That's incorrect, and OCR has made this clear in its guidance. If your organization maintains records of deceased patients — and you almost certainly do — those records are still PHI.

How to Build a PHI-Aware Culture in Your Organization

Understanding what PHI stands for is step one. Building a culture that actually protects it requires ongoing effort. Here's what I recommend based on years of consulting with covered entities:

  • Train annually, at minimum. New regulations, new threats, and staff turnover demand it. Explore the full HIPAA training catalog to find courses suited to different roles.
  • Conduct regular risk assessments. Identify where PHI lives in your organization — every system, every device, every workflow.
  • Implement minimum necessary standards. Staff should access only the PHI they need to perform their specific job function. No more.
  • Create a breach notification plan. Under the Breach Notification Rule, covered entities must notify affected individuals, HHS, and sometimes the media within specific timeframes. If you don't have this plan ready before a breach happens, you're already behind.
  • Document everything. OCR investigators don't accept verbal assurances. Policies, training records, risk assessments — put it all in writing.

The Bottom Line on What PHI Stands For

PHI stands for Protected Health Information, and it's the nucleus of every HIPAA obligation your organization carries. Every privacy policy, every security safeguard, every training module, every business associate agreement — they all exist to protect PHI.

If your workforce can't define it, can't recognize it, and doesn't know the rules governing it, compliance is an illusion. I've watched OCR tear apart organizations that had good intentions but poor execution. The difference between those organizations and the ones that avoid penalties almost always comes down to training and awareness.

Start with the fundamentals. Make sure every person in your organization — from the CEO to the newest hire — understands what PHI is and what their role is in protecting it. Our HIPAA Introduction Training 2026 course is built for exactly this purpose.

Because the next OCR complaint won't wait for your team to catch up.