A front-desk receptionist at a small dermatology clinic in Connecticut texted a patient's lab results to the wrong phone number. She didn't think it was a big deal — "it was just a name and a test result." Six months later, her employer was paying a five-figure settlement to HHS. That text contained PHI, and nobody on staff had been trained to recognize it.

Understanding what PHI means isn't an academic exercise. It's the difference between a normal Tuesday and a federal investigation. If you work for a covered entity — a hospital, health plan, clearinghouse, or any of their business associates — you need to know this cold. This post breaks it down in plain English, with real enforcement actions and practical guidance you can apply today.

What PHI Means Under HIPAA Law

PHI stands for Protected Health Information. Under the HIPAA Privacy Rule, PHI is any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or its business associate. That definition comes directly from 45 CFR § 160.103.

Here's the key phrase most people miss: individually identifiable. Health data on its own isn't PHI. A spreadsheet of blood pressure readings with no names, dates, or other identifiers attached? Not PHI. But the moment you can link that data to a specific person — through a name, date of birth, medical record number, email address, or even a ZIP code — it becomes PHI.

PHI covers information in any form. Paper charts. Verbal conversations. Electronic records (called ePHI). That sticky note on a nurse's desk with a patient's name and medication? PHI. The voicemail a physician leaves on a patient's phone? PHI. The billing record your clearinghouse processes? PHI.

The 18 Identifiers That Make Health Data PHI

HHS defines 18 specific identifiers that, when combined with health information, create PHI. I've seen organizations get tripped up on at least half of these because they seem harmless on their own.

  • Names
  • Geographic data smaller than a state (street address, city, ZIP code)
  • All dates directly related to an individual (birth date, admission date, discharge date, date of death)
  • Phone numbers
  • Fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Vehicle identifiers and serial numbers
  • Device identifiers and serial numbers
  • Web URLs
  • IP addresses
  • Biometric identifiers (fingerprints, voiceprints)
  • Full-face photographs and comparable images
  • Any other unique identifying number, characteristic, or code

That last one is the catch-all, and it's intentionally broad. If your internal tracking system assigns patients a unique code, that code is an identifier. If you think something might be an identifier, treat it like one.

Why Getting This Wrong Costs Real Money

OCR doesn't issue warnings for PHI mishandling. They issue penalties.

In 2018, the University of Texas MD Anderson Cancer Center lost an appeal of a $4.3 million penalty after unencrypted devices containing ePHI were stolen. The organization argued the data wasn't really PHI. The administrative law judge disagreed — emphatically. The case made clear that OCR takes an expansive view of what PHI means, and organizations that try to define it narrowly do so at their own risk.

In 2023, OCR settled with Yakima Valley Memorial Hospital for $240,000 after 23 emergency department security guards were found to have accessed patient medical records without a job-related reason. Every one of those records contained PHI. The breach affected 419 patients. The investigation revealed insufficient workforce training — guards simply didn't understand that accessing PHI without authorization violated federal law.

These aren't outliers. I've worked with organizations that assumed their data didn't qualify as PHI because it was "just scheduling information" or "only billing codes." Scheduling information that includes a patient's name, appointment time, and provider? That's PHI. Billing codes linked to a patient account number? PHI.

What Counts as PHI? A Quick-Reference Answer

If someone asks you "what does PHI mean," here's the answer in one sentence: PHI is any health information — in any format — that can be linked to a specific individual and is held by a covered entity or business associate. It includes past, present, and future physical or mental health conditions, the provision of healthcare, and payment for healthcare. If you can identify the patient, and the data relates to their health or healthcare, it's PHI.

Common PHI Examples People Miss

In my experience, here are the PHI examples that trip up even experienced staff:

  • Appointment reminders — A text saying "Reminder: your cardiology appointment is Thursday" links a person to a medical specialty.
  • Insurance explanation of benefits (EOBs) — These contain names, dates, procedure codes, and payment amounts.
  • Patient sign-in sheets — If they include the reason for the visit or the provider's name and specialty, they may reveal health information.
  • Wearable device data — When a covered entity collects heart rate, glucose, or activity data linked to a patient, it's ePHI.
  • Verbal disclosures — A nurse discussing a patient's condition in a hallway where others can hear is a PHI disclosure.

ePHI: The Digital Version That Gets Most of the Attention

When PHI exists in electronic form, HIPAA calls it ePHI — and the Security Rule adds an entire layer of requirements around it. You need administrative safeguards, physical safeguards, and technical safeguards. Encryption. Access controls. Audit logs. Backup and disaster recovery.

The reason ePHI gets so much regulatory attention is scale. A lost paper chart exposes one patient's PHI. A breached database can expose millions. OCR's Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media when unsecured PHI is compromised. For breaches affecting 500 or more individuals, the details go on OCR's public breach portal — sometimes called the "Wall of Shame."

Your organization's risk analysis should identify everywhere ePHI lives: EHR systems, email servers, cloud storage, laptops, mobile devices, even fax machines with digital memory. If you haven't mapped your ePHI environment recently, you have a gap.

The Training Gap That Creates Most PHI Violations

Here's what I've seen over and over: organizations invest heavily in technology — firewalls, encryption, access management — but underinvest in workforce training. Then a staff member emails a spreadsheet of patient names and diagnoses to her personal Gmail account to "work from home," and suddenly technology doesn't matter.

HIPAA requires covered entities and business associates to train their entire workforce on PHI handling. Not just clinicians. Not just IT. Everyone — including volunteers, students, and contractors who might encounter PHI. The HIPAA training catalog at HIPAACertify covers these fundamentals in a format designed for real-world application, not just checkbox compliance.

Training should cover what PHI means, how to identify it, the minimum necessary standard, proper disposal methods, and what to do when a potential breach occurs. If your last training session was a one-hour PowerPoint two years ago, you're exposed.

Build PHI Awareness Into Daily Operations

The best organizations I've worked with don't treat PHI awareness as an annual event. They build it into daily operations:

  • Huddle reminders: Start team meetings with a 30-second PHI scenario. "Is this PHI? What should you do?"
  • Access audits: Review who accessed what, monthly. Don't wait for an incident.
  • Secure disposal protocols: Shred bins at every workstation. Automated drive-wiping for decommissioned devices.
  • Incident response drills: Run a tabletop exercise at least once a year. Make sure every department knows the breach notification timeline — 60 days to notify individuals for most breaches.

If your staff can't confidently explain what PHI means and give three examples, your training program needs work. Explore role-specific HIPAA workforce training options that go beyond generic awareness slides.

PHI vs. Health Information vs. Consumer Health Data

One last distinction that matters more every year: not all health information is PHI. HIPAA only applies to covered entities and their business associates. If a fitness app collects your heart rate data and that app isn't connected to a covered entity, HIPAA doesn't apply. State laws like Washington's My Health My Data Act may cover that scenario, but HIPAA doesn't.

This distinction confuses people — especially patients. But for your organization, the question is straightforward: Are you a covered entity or business associate? Is the data individually identifiable? Does it relate to health, healthcare, or payment for healthcare? If yes to all three, it's PHI, and every HIPAA rule applies.

What Happens Next

Understanding what PHI means is foundational. Everything in HIPAA — the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule — revolves around protecting it. If your workforce doesn't understand PHI, your policies are just paper.

Start with a training baseline. Audit your current practices. Identify where PHI flows through your organization and whether every touchpoint is protected. The HIPAACertify training catalog is built to help organizations do exactly that — with courses tailored for clinical, administrative, and technical teams.

The receptionist in Connecticut didn't intend to violate HIPAA. She just didn't know what PHI meant. Don't let that be your organization's story.