Under HIPAA, PHI combines two elements: health-related information and identifiers that link it to a specific person. Health-related information covers past, present, or future physical or mental health, the provision of care, and payment for care. Information becomes PHI when it is held or handled by a covered entity or business associate. The same data held by an unrelated consumer company may not be PHI under HIPAA, although other privacy laws can still apply.
Under HIPAA, PHI combines two elements: health-related information and identifiers that link it to a specific person. Health-related information covers past, present, or future physical or mental health, the provision of care, and payment for care. Information becomes PHI when it is held or handled by a covered entity or business associate. The same data held by an unrelated consumer company may not be PHI under HIPAA, although other privacy laws can still apply.
PHI identifies an individual or provides a reasonable basis to identify them. A diagnosis linked to a name, email, or medical record number is a common example.
Covered entities, such as providers, health plans, and clearinghouses, and their business associates, such as software vendors and billing companies, handle PHI and must protect it under HIPAA.
PHI includes clinical details, appointment and treatment records, and billing and payment information tied to healthcare services, not just diagnoses or lab results.
Employment records held by a covered entity as an employer, certain education records, and information about people deceased more than 50 years are excluded from PHI under HIPAA.
HIPAA’s Safe Harbor de-identification method lists 18 types of identifiers that must be removed, for the individual and their relatives, employers, or household members, before data is considered de-identified. These identifiers are a practical way to recognize PHI in datasets, logs, and app features. When any of them appears alongside health information handled by a covered entity or business associate, assume the data is PHI and protect it accordingly.
Names, plus geographic subdivisions smaller than a state, such as street address, city, county, and most ZIP code digits, are identifiers that can link health data to individuals.
All elements of dates except year directly related to an individual, such as birth, admission, discharge, or death dates, and ages over 89, are identifiers under Safe Harbor.
Telephone numbers, fax numbers, and email addresses are identifiers. They frequently appear in app accounts, notifications, and support systems, so healthcare apps must protect them carefully.
Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, and vehicle and device identifiers or serial numbers all identify individuals.
Web URLs, IP addresses, biometric identifiers like fingerprints and voiceprints, full-face photographs, and any other unique identifying number, characteristic, or code complete the list of eighteen.
PHI appears in more places than most development teams expect. Beyond obvious clinical screens, it can surface in logs, analytics events, push notifications, support tickets, and file names. Recognizing these patterns early helps teams design architectures that keep PHI inside protected systems. The examples below show common PHI in healthcare apps, along with hidden locations our healthcare app development team designs around.
Diagnoses, medications, lab results, imaging, and visit notes linked to a patient account are clear examples of PHI in telemedicine, patient portal, and EHR applications.
An appointment with a specific specialist, such as an oncology visit, can reveal health information. Schedules, visit types, and reminders tied to patients are PHI.
Secure messages, chat transcripts, photos, and documents patients upload during care contain PHI and require encryption, access controls, and retention policies like other clinical data.
Logs with patient identifiers, analytics events including health details, and notification content can contain PHI. These hidden locations cause many unintended disclosures in healthcare apps.
Claims, statements, insurance details, and payment records tied to healthcare services are PHI, even when they contain no clinical detail beyond the service billed.
Building with PHI? Let's talk.
Protecting PHI requires both technical controls and organizational practices. Healthcare apps should minimize what they collect, encrypt what they keep, restrict who can access it, and record every access. Vendors that handle PHI need business associate agreements. These measures form the foundation of HIPAA compliance, explained in depth in our guide to building a HIPAA-compliant app.
Collect only PHI that features genuinely need, and avoid storing it on devices when possible. Less PHI means less risk, smaller breach impact, and simpler compliance work.
Encrypt PHI in transit and at rest across databases, backups, file storage, and devices. Encryption also influences breach notification obligations if data is lost or stolen.
Use unique accounts, MFA, and role-based permissions, and record every access to PHI in tamper-resistant audit logs reviewed regularly for unusual activity.
Every vendor creating, receiving, maintaining, or transmitting PHI on your behalf must sign a business associate agreement before PHI reaches its systems.
Scrub PHI from logs, error reports, analytics, notifications, and URLs. Independent app security services reviews often uncover these hidden leaks before attackers or auditors do.
PHI is health information that can identify a specific person and is handled by a healthcare provider, health plan, clearinghouse, or their business associates. Examples include a diagnosis linked to a name, appointment records, lab results, and medical bills tied to an individual patient.
Examples include patient names with diagnoses, medical record numbers, lab results, prescriptions, appointment details, insurance claims, billing records, photos used for care, and secure messages with clinicians. Even an email address becomes PHI when linked to health information handled by a covered entity.
Health information held by consumers themselves, de-identified data, employment records held by an employer, and health data collected by companies not covered by HIPAA are generally not PHI. However, other laws, such as FTC rules and state privacy laws, may still protect that information.
PHI is protected health information in any form, including paper, spoken, and electronic. ePHI is PHI in electronic form, such as data in databases, apps, or email. The HIPAA Security Rule applies specifically to ePHI, requiring administrative, physical, and technical safeguards.
The 18 identifiers include names, small geographic areas, dates except year, phone and fax numbers, emails, Social Security numbers, medical record and health plan numbers, account and license numbers, vehicle and device identifiers, URLs, IP addresses, biometrics, full-face photos, and other unique codes.
Minimize collection, encrypt data in transit and at rest, enforce MFA and role-based access, log all access, sign BAAs with vendors, and keep PHI out of logs and analytics. Book a free consultation to review how your app handles PHI.