---
title: "What Is PHI (Protected Health Information)? | Dawiso"
description: "PHI is individually identifiable health information held by a HIPAA covered entity or business associate. The 18 identifiers, de-identification and PHI vs PII."
url: "https://www.dawiso.com/glossary/phi-protected-health-information"
language: "en"
---

November 12, 2026

PHIprotected health informationHIPAA18 HIPAA identifiersde-identificationsensitive data

# What Is PHI (Protected Health Information)?

**Protected health information (PHI)** is individually identifiable health information that a HIPAA covered entity or business associate creates, receives, maintains or transmits, in electronic, paper or oral form. The definition sits in [45 CFR 160.103](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), and it covers far more than diagnoses: a name next to an appointment date, a billing record or an IP address logged by a patient portal can all be PHI.

Two things decide whether data is PHI. The first is the content: it relates to someone's health, health care or payment for health care, and it identifies the person or could reasonably be used to identify them. The second is the holder: under their applicability provisions, the HIPAA Privacy and Security Rules apply to health plans, health care clearinghouses, most health care providers and the vendors that handle PHI on their behalf. The same blood pressure reading is PHI in a hospital's EHR, while HHS guidance says that, unless an app is provided by a covered entity or its business associate, HIPAA generally does not protect data a person enters into a [mobile app for personal use](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/cell-phone-hipaa/index.html).

TL;DR

**PHI** is identifiable health, care or payment information held by a covered entity or business associate. HIPAA lists **18 identifiers** that must be removed under the Safe Harbor de-identification method; the alternative is a documented Expert Determination. Data that is properly de-identified is no longer PHI. Data that is not, including PHI in AI training sets and prompts, generally stays under the Privacy Rule, including its **minimum necessary** standard, and, when it is electronic, the Security Rule's safeguards. Governing PHI starts with knowing where it is: [classification](https://www.dawiso.com/glossary/data-classification), [lineage](https://www.dawiso.com/glossary/data-lineage) and named [owners](https://www.dawiso.com/glossary/data-ownership) in a [data catalog](https://www.dawiso.com/glossary/data-catalog).

## What Is Protected Health Information?

**PHI is individually identifiable health information, in any form or medium, held or transmitted by a covered entity or its business associate.** The regulation builds the term in three layers, all defined in 45 CFR 160.103.

1. **Health information** is any information, including genetic information, oral or recorded in any form, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and that relates to a person's past, present or future physical or mental health, the provision of health care to them, or payment for that care.
2. **Individually identifiable health information** is the subset of health information, including demographic information, that identifies the individual or where there is a reasonable basis to believe it can be used to identify them.
3. **Protected health information** is individually identifiable health information that is transmitted or maintained in electronic media or in any other form or medium.

The definition has four explicit exclusions: education records covered by FERPA, the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), employment records a covered entity holds in its role as employer, and information about a person who has been deceased for more than 50 years.

**Electronic protected health information (ePHI)** is the part of PHI that is transmitted by or maintained in electronic media. The Privacy Rule protects all PHI. The Security Rule, with its administrative, physical and technical safeguards, applies to ePHI only, which in practice means almost every data platform, warehouse and AI pipeline in a modern health system.

Some examples make the boundary concrete.

| Data held by a hospital | PHI? | Why |
| --- | --- | --- |
| A discharge summary with the patient's name | Yes | Health information plus a direct identifier |
| A claims table keyed by medical record number | Yes | Payment information linked to a unique identifier |
| A clinical note with the name removed but the admission date and town left in | Yes | Dates and small geographic units are identifiers under HIPAA |
| Count of flu admissions per month across the hospital | Usually no | Aggregate data that does not identify an individual |
| A nurse's HR file held by the hospital as employer | No | Employment records are excluded from the definition |

## Who Must Protect PHI?

**HIPAA obligations attach to covered entities and their business associates.** A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a HIPAA standard transaction, such as a claim.

Under 45 CFR 160.103, a **business associate** is a person or organization that creates, receives, maintains or transmits PHI on behalf of a covered entity for a regulated function, or that provides services such as legal, consulting, data aggregation, management or administrative work involving PHI. The definition names data analysis, processing or administration among the covered functions, which is why analytics vendors, cloud platforms and AI providers handling PHI usually fall under it. HHS guidance on cloud computing states that a cloud service provider that stores or processes ePHI is a business associate *even if it cannot view the data because it is encrypted and it holds no decryption key*.

Covered entities must have a business associate agreement (BAA) in place before a vendor handles PHI, and a business associate must pass the same obligations down to its own subcontractors. Our blog post on [what HIPAA compliance for AI requires you to document](https://www.dawiso.com/blog-post/hipaa-compliance-ai-phi-governance) covers what that means for AI vendors.

## What Are the 18 HIPAA Identifiers?

**The 18 HIPAA identifiers are the data elements that must be removed, for the individual and for their relatives, employers and household members, to de-identify data under the Safe Harbor method** of [45 CFR 164.514(b)(2)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514). They are often quoted as "the list of PHI", but the list defines what de-identification removes. Health information held by a covered entity or business associate and combined with any one of them is very likely PHI.

| # | Identifier | What the rule says in detail |
| --- | --- | --- |
| 1 | Names | Of the patient, relatives, employers or household members |
| 2 | Geographic subdivisions smaller than a state | Street address, city, county, precinct, ZIP code and equivalent geocodes. The first three ZIP digits may stay if the area they cover has more than 20,000 people; otherwise they are changed to 000 |
| 3 | All elements of dates except year | Birth, admission, discharge and death dates. Ages over 89, and all date elements (including year) that indicate such an age, must be removed; they may be aggregated into a single category of age 90 or older |
| 4 | Telephone numbers |  |
| 5 | Fax numbers |  |
| 6 | Email addresses |  |
| 7 | Social Security numbers |  |
| 8 | Medical record numbers |  |
| 9 | Health plan beneficiary numbers |  |
| 10 | Account numbers |  |
| 11 | Certificate and license numbers |  |
| 12 | Vehicle identifiers and serial numbers | Including license plate numbers |
| 13 | Device identifiers and serial numbers | For example, the serial number of an implanted device |
| 14 | Web URLs |  |
| 15 | IP addresses |  |
| 16 | Biometric identifiers | Including finger and voice prints |
| 17 | Full-face photographs and comparable images |  |
| 18 | Any other unique identifying number, characteristic or code | Except a re-identification code assigned under the conditions in 164.514(c) |

Removing the 18 identifiers is not quite enough on its own. Safe Harbor also requires that the covered entity has no **actual knowledge** that the remaining information could identify an individual, alone or combined with other information. A rare diagnosis combined with a distinctive occupation or a widely reported event mentioned in a note, for example, can identify a person even after every listed identifier is gone.

**Free text counts.** HHS de-identification guidance states that the standard makes no distinction between structured fields and free text: an identifier must be removed wherever it appears in a record, including discharge summaries, progress notes and lab interpretations. This matters for AI, because clinical notes are exactly the unstructured text that language models and retrieval pipelines consume.

## How Does HIPAA De-identification Work?

**HIPAA recognizes two methods of de-identification: Safe Harbor and Expert Determination.** Health information that meets either one is not individually identifiable, so it is no longer PHI and the Privacy Rule no longer restricts its use. A covered entity may use PHI to create de-identified data, or give it to a business associate for that purpose.

|  | Safe Harbor, 164.514(b)(2) | Expert Determination, 164.514(b)(1) |
| --- | --- | --- |
| **What it requires** | Remove all 18 identifiers and have no actual knowledge that the rest could identify someone | A person with appropriate knowledge and experience applies generally accepted statistical and scientific methods and determines that "the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual" |
| **Documentation** | Not prescribed by the rule; keeping evidence that each identifier was removed, including from free text, is good practice | The expert must document the methods and results of the analysis |
| **Dates and geography** | Only years, and three-digit ZIP codes for areas over 20,000 people | No fixed list; whatever detail remains must still meet the "very small" risk determination |
| **Risk threshold** | None; the list of identifiers is fixed by the rule | HHS sets no numerical threshold; the expert defines "very small" for the data set and its environment |
| **Typical use** | Simple extracts, public data sets | Analytics and model development that need dates, locations or rare values |

Three details from the rule and from HHS guidance are often missed.

- **Re-identification codes are allowed.** Under 164.514(c), a covered entity may assign a code so it can re-link de-identified records, provided the code is not derived from or related to information about the individual, cannot be translated to identify them, is not used or disclosed for any other purpose, and the re-identification mechanism is not disclosed.
- **Expert determinations can expire.** HHS notes that some practitioners issue time-limited certifications, because computing power and available data change the risk over time.
- **A limited data set is still PHI.** Under [164.514(e)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), a covered entity can strip 16 direct identifiers while keeping dates, town or city, state and ZIP code. That limited data set may be used only for research, public health or health care operations, and only under a data use agreement. It is not de-identified.

## PHI vs PII

**PHI is a defined term in one US regulation, while [PII](https://www.dawiso.com/glossary/pii-personally-identifiable-information) is a broad description of any information that can identify a person.** Most PHI is also PII, but much PII, such as a customer's email address in a retailer's CRM, has nothing to do with HIPAA.

|  | PHI | PII |
| --- | --- | --- |
| **Legal basis** | Defined in 45 CFR 160.103 under HIPAA | No single legal definition; NIST SP 800-122 is the common reference in the US |
| **Scope** | Identifiable health, care or payment information | Any information that can distinguish or trace an individual |
| **Who it binds** | Covered entities and business associates | Depends on the law: state privacy laws, GLBA, COPPA, and others |
| **De-identification standard** | Safe Harbor or Expert Determination | Varies by law; no single federal test |
| **EU equivalent** | Data concerning health, a special category under GDPR Article 9 | Personal data under GDPR Article 4 |

For a governance program, the practical consequence is that a column can carry several labels at once. A patient email address in a hospital's portal database is PII, PHI and, where GDPR applies, personal data that may also count as data concerning health. Classification schemes that allow only one label per asset tend to lose exactly this information. For the wider privacy picture, see [data privacy](https://www.dawiso.com/glossary/data-privacy).

## What Is the Minimum Necessary Standard?

**The minimum necessary standard requires covered entities and business associates to make reasonable efforts to limit the PHI they use, disclose or request to the minimum necessary to accomplish the intended purpose** ([45 CFR 164.502(b)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502)).

The standard does not apply to every flow. The exceptions listed in 164.502(b)(2) include disclosures to or requests by a health care provider for treatment, uses or disclosures to the individual, uses or disclosures under the individual's authorization, disclosures to HHS for enforcement, and uses or disclosures required by law.

For internal use, [164.514(d)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) turns the principle into concrete obligations. A covered entity must identify the persons or classes of persons in its workforce who need access to PHI, the categories of PHI each of them needs, and any conditions on that access, and then make reasonable efforts to limit access accordingly. Routine, recurring disclosures need policies and procedures, which may be standard protocols. That is a role-to-data-category mapping, which is the same structure that [data access management](https://www.dawiso.com/glossary/data-access-management) and [data masking](https://www.dawiso.com/glossary/data-masking) policies implement in a data platform.

## Is PHI Used in AI Still PHI?

**Yes. PHI does not lose its status because it is copied into a training set, an embedding index or a prompt.** The HIPAA Rules in force today do not mention artificial intelligence, so they apply to AI the same way they apply to any other information system that creates, receives, maintains or transmits PHI.

HHS took the same position in the preamble to its [proposed HIPAA Security Rule update](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information), published on January 6, 2025: ePHI, including ePHI in AI training data, prediction models and algorithm data maintained by a regulated entity for covered functions, is protected by the HIPAA Rules. As of November 2026 the update remains a proposal, and no final rule has been published. The interpretation in the preamble is not a new requirement; it describes how HHS reads the rules that already apply.

Three governance questions follow for every AI use of PHI.

- **Is the input PHI, a limited data set or de-identified data?** Each has different rules, and only properly de-identified data leaves HIPAA's scope.
- **Is the AI vendor a business associate?** A provider that processes PHI on the covered entity's behalf generally is, and needs a BAA before the first record is sent.
- **Can the organization show where the PHI went?** Training sets, retrieval indexes and model outputs can be new copies of PHI that need the same classification, access control and audit trail as the source.

Our blog post on [HIPAA compliance for AI](https://www.dawiso.com/blog-post/hipaa-compliance-ai-phi-governance) walks through the records each of these questions requires. Privacy-preserving training approaches such as [federated learning](https://www.dawiso.com/glossary/federated-learning) and [synthetic data](https://www.dawiso.com/glossary/synthetic-data) can reduce how much PHI moves, but they do not remove the need to document what data the models were built from.

## How to Govern PHI in a Data Catalog

**Governing PHI starts with an inventory of where it lives, and a [data catalog](https://www.dawiso.com/glossary/data-catalog) is where that inventory is maintained.** The catalog holds metadata about PHI, such as which tables, columns, documents and reports contain it, rather than the patient records themselves.

1. **Classify.** Mark the assets that contain PHI, at column level where possible, and include unstructured sources such as clinical notes and scanned documents. See [data classification](https://www.dawiso.com/glossary/data-classification) and [unstructured data governance](https://www.dawiso.com/glossary/unstructured-data-governance).
2. **Trace.** Record [data lineage](https://www.dawiso.com/glossary/data-lineage) from the EHR or claims system through every copy, extract, feature table and AI index, so that the organization can show where PHI went and assess the impact of a change. [Column-level lineage](https://www.dawiso.com/glossary/column-level-lineage) shows which downstream fields inherit an identifier.
3. **Assign owners.** Give every PHI-bearing asset an accountable [owner](https://www.dawiso.com/glossary/data-ownership) who decides on access requests and answers for the data in a risk analysis or audit.
4. **Connect access to purpose.** Grant access to PHI by role and purpose, with masked access as the default for people who do not need identities, in line with the minimum necessary standard.
5. **Keep the record.** HIPAA requires Security Rule documentation to be retained for six years from its creation or last effective date ([45 CFR 164.316(b)(2)(i)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C)). An access decision with its reason, kept next to the asset it concerns, is easier to produce later than one buried in email.

In Dawiso, assets carry a [PII and confidentiality classification](https://help.dawiso.com/actual/data-product-catalog/) that is aggregated into a badge on each port of a data product, so a requester sees how sensitive a product is before asking for access. Access requests in the [Data Market](https://help.dawiso.com/actual/data-market-requesting-access/) state a use case, a level of access and a duration, with masked access to personal data as the default where the source supports masking, and Dawiso records the grant and the reason behind it. Metadata is ingested without reading row values when sources connect through the [Dawiso Integration Runtime](https://help.dawiso.com/actual/dawiso-integration-runtime-security-overview/). Classifications are set by people or, through the [MCP server](https://help.dawiso.com/actual/dawiso-model-context-protocol-mcp/), by AI assistants that classify and label objects on a user's behalf. Dawiso is a governance platform. It does not de-identify, block or encrypt patient data, and using it does not make an organization HIPAA compliant.

## Sources

*This article is for general information and is not legal advice.*

Regulations are cited from the Electronic Code of Federal Regulations (eCFR), the official, continuously updated edition maintained by the Office of the Federal Register.

- eCFR, [45 CFR 160.103, Definitions](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) (health information, individually identifiable health information, protected health information, electronic PHI, covered entity, business associate).
- eCFR, [45 CFR 164.502, Uses and disclosures of PHI, general rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (minimum necessary standard and its exceptions, use of PHI to create de-identified data).
- eCFR, [45 CFR 164.514, Other requirements relating to uses and disclosures of PHI](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (de-identification standard, the 18 Safe Harbor identifiers, re-identification codes, minimum necessary implementation, limited data set).
- eCFR, [45 CFR Part 164 Subpart C, Security Standards for the Protection of ePHI](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C) (documentation retention, 164.316).
- US Department of Health and Human Services, [Guidance Regarding Methods for De-identification of PHI](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) (no numerical risk threshold, time-limited certifications, identifiers in free text).
- US Department of Health and Human Services, [Guidance on HIPAA and Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) (cloud providers storing encrypted ePHI are business associates).
- Federal Register, [HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information), proposed rule, 90 FR 898, January 6, 2025 (ePHI in AI training data and models).
- US Department of Health and Human Services, [HIPAA Security Rule NPRM](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html) (status of the proposed rule).
- Dawiso Help, [Data Product Catalog](https://help.dawiso.com/actual/data-product-catalog/), [Requesting access to a data product](https://help.dawiso.com/actual/data-market-requesting-access/) and [Dawiso Integration Runtime security overview](https://help.dawiso.com/actual/dawiso-integration-runtime-security-overview/).

[See it in action](https://www.dawiso.com/product/data-catalog)

Data & Analytics Catalog

Create a unified view of your data assets and gain insights faster with automated data discovery.

### Table of contents

What Is Protected Health Information?Who Must Protect PHI?What Are the 18 HIPAA Identifiers?How Does HIPAA De-identification Work?PHI vs PIIWhat Is the Minimum Necessary Standard?Is PHI Used in AI Still PHI?How to Govern PHI in a Data CatalogSources

## Related Terms

### [What Is PII (Personally Identifiable Information)?](https://www.dawiso.com/glossary/pii-personally-identifiable-information)

PII is any data that can identify a specific individual - name, email, IP, biometrics, location. Categories, regulations, and how to govern PII at scale.

Read more →

### [What Is Data Classification?](https://www.dawiso.com/glossary/data-classification)

Data classification is the process of organizing data into categories based on sensitivity, type, or business value. Learn how automated classification powers data governance, GDPR compliance, and security.

Read more →

### [What Is a CISO (Chief Information Security Officer)?](https://www.dawiso.com/glossary/ciso-chief-information-security-officer)

The CISO is the executive accountable for information security, cyber risk, and regulatory readiness. Learn the role, scope, and link to data governance.

Read more →