October 23, 2026

What Qualifies as Protected Health Information (PHI)?— ✦ —

Protected Health Information, or PHI, generally includes individually identifiable information about a person’s health, healthcare services, or payment for care that is held or transmitted by a HIPAA covered entity or its business associate. It can appear in electronic records, printed documents, photographs, or spoken conversations. PHI extends beyond diagnoses and treatment notes, so understanding where it appears is an important part of managing patient information.

Health Information Must Be Identifiable

Information generally qualifies as PHI when it concerns someone’s past, present, or future health, care, or payment and identifies that person or could reasonably be used to identify them.

For example, a patient’s name attached to a laboratory result would generally qualify. A record can also be identifiable without a name if other details reasonably reveal whose information it contains. The organization holding or handling the information also matters when determining whether HIPAA applies.

Medical Records Are Common Examples

Within a HIPAA covered practice, identifiable patient records commonly contain PHI. Examples include:

  • Medical histories and documented symptoms.
  • Diagnoses and treatment plans.
  • Prescription records.
  • Laboratory results and diagnostic images.
  • Referral letters and discharge instructions.

For instance, a referral letter connecting a named patient with a recommended specialist generally contains PHI. The information does not need to describe a serious condition or an unusual procedure to qualify.

Billing and Appointment Details Can Also Qualify

PHI can include identifiable information about receiving or paying for healthcare. Insurance claims, patient invoices, and appointment records may therefore qualify even when they do not contain a detailed diagnosis.

Consider an appointment reminder that identifies a patient and confirms a visit to a healthcare practice. Similarly, a billing statement connecting someone to a medical service can reveal information about their care. Staff should recognize that administrative records can contain PHI alongside clinical documents.

PHI Exists Beyond Electronic Patient Charts

The HIPAA Privacy Rule covers PHI in electronic, paper, and oral forms. A printed patient list, a faxed referral, or a conversation about an identifiable patient’s treatment can contain protected information.

For example, discussing a patient’s test results in a hallway still involves PHI even though nobody opens a computer. Recognizing the different forms patient information takes helps employees understand why privacy practices apply throughout the workplace.

Removing a Name Does Not Automatically De-Identify a Record

A document may remain identifiable after a patient’s name is removed. Dates, contact details, record numbers, photographs, and information in narrative notes can still connect the record to an individual.

HIPAA recognizes two methods for de-identification: Expert Determination and Safe Harbor. Each has specific requirements. Safe Harbor involves removing specified identifiers and having no actual knowledge that the remaining information could identify the individual. Simply deleting a name or replacing it with initials does not establish that those requirements have been met.

Some Health-Related Information Falls Outside PHI

Not every piece of health information is PHI under HIPAA. Certain education records covered by FERPA and employment records held by a covered entity in its role as an employer are excluded from the definition.

Information properly de-identified under HIPAA is also no longer PHI. However, falling outside HIPAA’s definition does not automatically mean information is appropriate for unrestricted sharing. Other privacy obligations may still apply.

Understanding Your Technology Helps You Manage Patient Information

Once your practice identifies where PHI is handled, it can review the technology supporting those workflows. Patient information may pass through computers, email, shared storage, business applications, and backup systems.

Simplicity IT provides managed IT, cybersecurity, cloud, and backup services, including technical controls that support an organization’s HIPAA compliance efforts. Our services help businesses assess their environments and prioritize improvements around their operational needs. Technology is one part of compliance, alongside organizational policies, employee practices, and other responsibilities.

Contact Simplicity IT to discuss your practice’s technology, security concerns, and support needs. Schedule your Discovery Call here.