A therapist in Oregon left a voicemail for a patient's emergency contact. She mentioned the patient's diagnosis, medication, and next appointment time. That single voicemail contained at least three distinct types of protected health information — and it triggered a complaint to the Office for Civil Rights (OCR) that took the practice eighteen months to resolve.
I share that story because most people think PHI is just a medical chart or a lab result. It's not. PHI is sprawling, shape-shifting, and hiding in places your staff walks past every day. If you don't know every form it takes, you can't protect it. And if you can't protect it, you're exposed.
This post is the field guide I wish someone had handed me years ago. We'll walk through every category of PHI that HIPAA covers, where each type lives in your workflow, and the enforcement actions that prove regulators take each one seriously.
What Exactly Counts as Protected Health Information?
Here's the definition that matters. Under the HIPAA Privacy Rule, protected health information is any individually identifiable health information that a covered entity or business associate creates, receives, maintains, or transmits. It must relate to a person's past, present, or future physical or mental health condition, the provision of health care, or payment for health care.
The key phrase is "individually identifiable." A blood pressure reading of 140/90 standing alone isn't PHI. Attach it to a name, date of birth, or medical record number, and it becomes PHI instantly.
The 18 Identifiers That Turn Health Data Into PHI
HHS defined 18 specific identifiers that make health information individually identifiable. If any one of these is linked to health data, you're dealing with PHI:
- Names
- Geographic data smaller than a state
- Dates (except year) related to an individual — birth date, admission date, discharge date, date of death
- Phone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers (fingerprints, voiceprints)
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic, or code
I've seen organizations strip names and dates from a dataset but leave zip codes intact — and that still qualifies as PHI. The 18-identifier list is unforgiving by design.
Clinical and Medical Record PHI
This is the category everyone pictures first. Doctor's notes, diagnostic imaging, pathology reports, prescription histories, surgical records, nursing assessments. Every piece of your patient's clinical story is PHI when tied to an identifier.
What catches organizations off guard is the breadth. Mental health psychotherapy notes carry even stronger protections under the Privacy Rule — they require separate, specific patient authorization before most disclosures. If your organization provides behavioral health services, specialized training matters. Our HIPAA Training for Mental & Behavioral Health covers exactly these heightened requirements.
Lab Results and Diagnostic Data
Blood work, imaging reads, genetic testing results — all PHI. Genetic information gets an additional layer of protection under the Genetic Information Nondiscrimination Act (GINA), which intersects with HIPAA in ways that trip up even experienced compliance officers.
Medication and Prescription Records
Pharmacy records, e-prescribing logs, medication reconciliation documents. A prescription bottle with a patient label sitting on a front desk is PHI in plain sight. I've walked into clinics and spotted exactly that.
Electronic PHI: The Category That Draws the Biggest Fines
Electronic protected health information — ePHI — is any PHI created, stored, or transmitted electronically. Think EHR systems, patient portals, billing software, email, text messages, cloud backups, even fax-to-email services.
The HIPAA Security Rule exists specifically to govern ePHI. It requires administrative, physical, and technical safeguards. And when those safeguards fail, OCR doesn't look the other way.
In 2018, Anthem Inc. paid $16 million to settle HIPAA violations after a breach exposed the ePHI of nearly 79 million people. Hackers got in through a phishing email. The settlement remains the largest in HIPAA history. It's a reminder that ePHI protection isn't optional — it's the center of regulatory gravity.
Data at Rest vs. Data in Transit
Your ePHI risk profile covers both. Data at rest sits on servers, hard drives, and backup tapes. Data in transit moves through email, APIs, and file transfers. Both states demand encryption and access controls. Many breach notification obligations trace back to unencrypted ePHI that was stolen or lost.
Verbal PHI: The Type Everyone Forgets
Here's the type of protected health information that generates the most preventable complaints: spoken words.
A receptionist confirming a diagnosis over the phone in a crowded waiting room. A nurse discussing a case in a hospital elevator. A billing clerk leaving a detailed voicemail on a shared family phone. Every one of these is a verbal PHI disclosure, and every one can trigger an OCR investigation.
The Privacy Rule doesn't just cover paper and pixels. It covers what comes out of your mouth. I've consulted with practices that had airtight encryption and firewalls but zero policies governing hallway conversations. That gap is real and common.
If your workforce hasn't been trained on this specific risk, our course Verbal Disclosures: Watch What You Say is built for exactly this scenario.
Billing, Claims, and Financial PHI
Explanation of Benefits (EOB) statements, insurance claims, billing records, payment histories — all PHI. They tie a patient's identity to their health conditions, procedures, and providers.
Financial PHI often passes through more hands than clinical data. Front-desk staff, billing departments, clearinghouses, third-party billing companies. Each handoff is a potential exposure point. Your business associate agreements need to cover every one of those entities.
Insurance Enrollment and Eligibility Records
Health plan enrollment forms, eligibility verification logs, and coordination of benefits documents all contain PHI. Health plans are covered entities under HIPAA, and every piece of member data they handle falls under the Privacy and Security Rules.
Research Data: When PHI Enters the Lab
PHI used in clinical research doesn't lose its protected status. Researchers at covered entities must either obtain patient authorization, use a limited data set with a data use agreement, or work with a properly constituted IRB or privacy board to obtain a waiver of authorization.
Stripping the 18 identifiers through expert determination or safe harbor methods creates de-identified data, which is no longer PHI. But partial de-identification — removing some identifiers but not all — still leaves you with PHI and full HIPAA obligations.
The $1.5 Million Lesson From a Stolen Laptop
In 2015, Medical Informatics Engineering paid $100,000 in a settlement with OCR after a breach affecting 3.5 million individuals. But the case that hits closer to home for small practices: Lifespan Health System Affiliated Covered Entity paid $1,040,000 in 2020 after an unencrypted stolen laptop exposed PHI. No exotic hacking. Just a laptop without encryption sitting in an employee's car.
These cases show that every type of PHI — clinical, electronic, financial — demands the same rigor. The form factor doesn't matter. A paper chart left in a taxi and an unencrypted USB drive in a parking lot carry the same regulatory weight.
How Many Types of PHI Does HIPAA Recognize?
HIPAA doesn't create a numbered list of "types." Instead, it defines PHI broadly and then specifies 18 identifiers that make health data individually identifiable. In practice, PHI falls into these functional categories: clinical/medical records, electronic PHI (ePHI), verbal disclosures, billing and claims data, insurance enrollment records, research data, and psychotherapy notes. Any health information linked to one of the 18 identifiers — in any format, on any medium — qualifies as PHI under the Privacy Rule.
Building a Workforce That Recognizes Every Form of PHI
Compliance programs fail when training stays abstract. Your staff needs to see PHI the way a firefighter sees hazards — constantly scanning, identifying threats before they ignite.
That means scenario-based training. Not just "PHI is important" slides, but walkthroughs of real situations: the appointment reminder left on a shared voicemail, the screen visible to the waiting room, the email sent to the wrong address.
Our full HIPAA training catalog is built around these real-world scenarios. Every module maps directly to the types of protected health information your teams encounter daily — because awareness that doesn't change behavior isn't worth the time it took to deliver.
Your Next Step Is Specific, Not General
Audit your workflows against the categories above. Walk your hallways and listen. Open your email logs and look. Check whether your business associate agreements cover every entity that touches billing PHI. Verify that your ePHI is encrypted at rest and in transit.
The organizations that avoid seven-figure settlements aren't lucky. They're specific. They know exactly what types of protected health information flow through their operations, and they've built guardrails around every single one.
Start there. The regulators already have.