What Is Considered PHI Under HIPAA?

Core insight

PHI under HIPAA is information that can identify a person - but HIPAA generally applies when that information is held or handled by a healthcare provider, health plan, or their business associates. The same heart rate value might be harmless in a fitness app but become PHI in a post-op care platform. For teams building healthcare applications, understanding this distinction can mean the difference between building freely and unknowingly taking on HIPAA obligations. This guide will help you avoid common pitfalls, show how modern identifiers - like social media aliases - complicate things, and give you a practical framework for deciding whether your app is collecting PHI before you find out the hard way. 

The 18 HIPAA Identifiers - And What Most People Get Wrong About Them

If you search for "what is PHI," most sources will hand you a list of 18 identifiers, creating a false sense that this is the basis of what you need to pay attention to. The truth is a bit more complicated.

That list is real, but focusing on it creates an important misunderstanding: the 18 identifiers are not a definition of PHI. They are a checklist for one specific de-identification method - Safe Harbor - published in 1999. Using them as a definition of PHI means you miss not only what pieces of data makes a person identifiable, but also in which situation they are actually considered PHI. 

With that said, here is the list, because you need to know it:

This list is important because it governs de-identification - the process of stripping data of identifying information so it can be used for research, analytics, or AI training without HIPAA restrictions applying. We cover de-identification methods in detail later.

What is important is that these are not the only data points that can identify a person - after all, the world in which your application will operate today looks nothing like it did in 1999. But among all of such datapoints, these were flagged by regulators as high-risk. When these appear in your logs, analytics events, or API responses alongside health-related data, you are in territory that warrants a closer look.

For the full breakdown of how each identifier is interpreted in practice, the HIPAA Journal's guide to what is considered PHI is the most thorough public resource available. 

With the list in context, we can focus on what PHI actually is.

What is considered PHI?

PHI is individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 

That’s for a definition. Let’s take a look at every element of it. 

Under HIPAA, information is PHI when two conditions are true simultaneously.

Condition 1: Identifiability. The information identifies an individual, or there is a reasonable basis to believe it could be used to identify them. This covers both direct identifiers (name, email) and indirect ones (a combination of data points that narrows to one person).

Condition 2: Healthcare purpose. The information relates to an individual's past, present, or future physical or mental health condition; the provision of healthcare to the individual; or the past, present, or future payment for that care.

Both must be true at the same time. An email address in a marketing database satisfies neither - it identifies someone but has no healthcare purpose. The same email address in a patient intake system satisfies both. A heart rate reading in a consumer fitness app satisfies condition 2 but not condition 1 if there is no individual linked to it. The same reading in a provider-ordered cardiac rehabilitation program satisfies both.

One additional constraint: HIPAA only applies when this information is held or transmitted by a covered entity or business associate. Information that meets both conditions above, but is held by an entity with no relationship to the healthcare system, falls outside HIPAA's reach - though it may be subject to FTC rules or state privacy law.

Who Does HIPAA Apply To 

Covered entities are the organizations HIPAA was originally written for:

• Healthcare providers who electronically transmit standard transactions - hospitals, physicians, dentists, pharmacies, and others. Note that using email does not make a provider a covered entity; the trigger is transmitting standardized transactions like claims or eligibility inquiries.

• Health plans - insurers, HMOs, Medicare, Medicaid, employer-sponsored group health plans.

• Healthcare clearinghouses - organizations that translate non-standard health data into standard formats, such as billing services.

Most software companies should pay attention to the business associates part. A business associate is:

•  any person or organization, outside a covered entity's workforce, 

• that performs functions or services for a covered entity 

• and, in doing so, creates, receives, maintains, or transmits PHI.

Common examples include billing platforms, medical transcription services, cloud storage providers, IT consultants with access to patient systems, and companies like us: healthcare software developers and their infrastructure vendors.

You become a business associate the moment you perform a function that meets the definition, not the moment you sign a Business Associate Agreement. Avoiding a BAA removes the contractual protection - but it does not stop you from being considered a business associate. And because of that, you can be directly liable to HHS Office for Civil Rights (because of the 2013 HIPAA Omnibus Rule) - independently of their covered entity customers.

The subcontractor chain extends this further. If you are a business associate and you use a subcontractor that touches PHI - for example, a hosting provider - that subcontractor is also a business associate and must be covered by a BAA.

Cloud providers have specific implications here. AWS, GCP, and Azure will sign BAAs, but this requires active configuration: not all services on each platform are HIPAA-eligible, and simply using a BAA-covered account does not make every resource within it compliant.

Checklist: Is Your App Handling PHI Under HIPAA?

Rather than asking “Is this field PHI?”, ask: “Does this data flow involve PHI subject to HIPAA?”

1. Are you a Covered Entity or Business Associate? Are you a healthcare provider, health plan, healthcare clearinghouse, or a vendor handling PHI on behalf of one of them? Simply being used by a healthcare organization does not automatically make you a Business Associate.

2. Does the data relate to health, healthcare, or payment for healthcare? Look beyond obvious medical records. PHI can appear in messages, support tickets, logs, analytics, error traces, uploaded files, and LLM prompts.

3. Can the information identify an individual? Consider both direct and indirect identification, including combinations of fields. Don't evaluate each field in isolation.

4. Does the PHI flow through your systems or third-party services? Trace the data end-to-end: application, database, logs, analytics, support tools, backups, and AI/LLM providers. For each recipient, determine whether they are handling PHI on behalf of a Covered Entity or Business Associate and whether a BAA is required.

If all four questions point toward yes, you are handling HIPAA-regulated PHI - and the full framework applies: BAAs, Security Rule safeguards, permitted uses and disclosures, and breach notification obligations. 

If your app connects to an EHR system, the integration layer itself also processes ePHI - here's how EHR integrations work and what to consider.

What Is NOT Considered PHI

Sometimes, a data point is just a data point, not PHI. Treating it as such will result in operational overhead, making the scope of your product needlessly complicated. At the same time, the temptation to treat everything as PHI is understandable - after all, that’s a sure way to avoid any mistakes. 

Examples of non-PHI are, for example:

Employment records held by a covered entity in its capacity as an employer - not as a healthcare provider - are excluded. An employee's sick leave record at a hospital is not PHI; that same employee's patient record at the same hospital is.

Health records held by schools - including for example records maintained by a school nurse - are governed by the Family Educational Rights and Privacy Act (FERPA), not HIPAA. If you are building for an educational institution, FERPA is the framework that applies to student health data, even when that data looks identical to what would be PHI in a clinical setting. 

Data held by entities with no HIPAA relationship. A consumer wellness app with no contract with any covered entity or business associate is not subject to HIPAA, even if it stores sensitive health data. It may be subject to FTC enforcement under the Health Breach Notification Rule, and increasingly to state privacy laws, but HIPAA's framework does not apply.

There can also be information that is no longer PHI: de-identified health information. You may want to de-identified PHI when, for example, you want to present a health report based on your platform, or use the data to train a model predicting the disease progression. 

HIPAA recognizes two de-identification methods under 45 CFR §164.514:

• Safe Harbor: remove the 18 identifiers listed above and confirm no actual knowledge that the remaining data could identify anyone.

• Expert Determination: a qualified statistician documents that the risk of re-identification is very small. This method allows retaining more analytically useful data - including granular dates and regional geography - but requires ongoing governance as data environments change.

Neither method is a one-time event. Both require reassessment when datasets change or new external data sources become available that could enable re-identification through combination.

PHI vs. ePHI - Does the Format Change Your Obligations?

Electronic protected health information (ePHI) is PHI that is created, stored, transmitted, or received electronically. The distinction matters for one specific reason: the HIPAA Security Rule applies primarily to ePHI, while the Privacy Rule applies to PHI in all formats - paper, oral, and electronic. 

For any digital health product, the distinction is largely academic: virtually all PHI you handle is ePHI, which means both rules apply. 

What Getting PHI Wrong Costs - And What Getting It Right Allows

Getting PHI wrong can be expensive.

HIPAA civil penalties currently range from $127 to $63,973 per violation. Annual caps for violations of the same requirement range from $25,000 to $1,919,173. For willful neglect that is not corrected within the applicable 30-day period, the minimum penalty is $63,973 per violation. These penalty amounts are adjusted periodically for inflation. 

Criminal offenses - knowingly obtaining or disclosing PHI - can result in fines up to $250,000 and ten years in prison.

Additionally, the financial exposure is only part of it. A PHI incident triggers breach notification obligations, OCR investigations, and emergency remediation - none of which is where you want your engineering’s team's attention. What’s more, for products selling into enterprise health systems, a compliance incident can stall or kill deals that took months to develop.

The compliance burden looks very different when PHI boundaries are defined from the start. Clear data classification at ingestion, BAAs in place before PHI is shared, and a known de-identification boundary - these turn reactive compliance into architecture. 

PHI classification shapes your architecture from day one. If you're building a healthcare product and want to get it right from the start, talk to our team. 

FAQ

What does PHI stand for in HIPAA?

PHI stands for Protected Health Information. Under HIPAA, it generally means individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate.

Is an email address PHI under HIPAA?

It can be. An email address is one of HIPAA's 18 identifiers and can be PHI when it is associated with individually identifiable health information held or transmitted by a covered entity or business associate. An email address in an unrelated consumer database is not PHI simply because it can identify a person.

Is an IP address PHI under HIPAA?

It can be. An IP address is one of HIPAA's 18 identifiers. When a covered entity or business associate collects an IP address together with health-related information or activity that is individually identifiable, the resulting information may be PHI. The context and the relationship between the parties matter.

What is the difference between PHI and ePHI?

ePHI is simply PHI in electronic form. The HIPAA Privacy Rule applies to PHI generally, while the Security Rule specifically addresses electronic PHI and establishes administrative, physical, and technical safeguards for it.

Does HIPAA apply to health apps and wearables?

It depends on the app's relationship to HIPAA-regulated entities. An app developed or provided by or on behalf of a covered entity or business associate may be subject to HIPAA and may make its developer a business associate. A consumer health or fitness app that operates independently of a covered entity or business associate is generally outside HIPAA, although other laws may apply.

What is de-identified health information?

Under HIPAA, health information is de-identified when it meets one of two recognized methods: Safe Harbor or Expert Determination. Properly de-identified information is no longer PHI under HIPAA. Safe Harbor requires removal of 18 specified identifiers and that the covered entity have no actual knowledge that the remaining information could identify an individual. Expert Determination requires a qualified expert to determine that the risk of re-identification is very small.

What does “identifiable” mean under HIPAA?

Information is identifiable when it directly identifies an individual - such as by name, email, or Social Security number - or when there is a reasonable basis to believe it could be used to identify them. Even a combination of seemingly innocuous details, such as diagnosis, age, and ZIP code, may make information identifiable.

What are examples of PHI?

PHI is individually identifiable health information held or transmitted by a covered entity or business associate. A name paired with a diagnosis is PHI. An appointment date linked to a patient record may be PHI. An email address submitted to a healthcare provider in connection with care may also be PHI. The same name in a general marketing database, without health information, is not PHI.

Can PHI be shared without patient authorization?

Yes. HIPAA permits certain uses and disclosures without written authorization, including for treatment, payment, and healthcare operations. Other exceptions include certain public health, law enforcement, and research disclosures. Uses or disclosures not otherwise permitted by HIPAA generally require the individual's written authorization.