PHI Meaning: What Does PHI Stand For in Healthcare?

PHI stands for protected health information: individually identifiable health information that a HIPAA covered entity or its business associate transmits or maintains in any form, whether electronic, paper or spoken (45 CFR 160.103; HHS). Put simply, it is information about a person's health, care or payment for care that identifies them, or could reasonably be used to. A clinic's website can collect PHI too, for example when a visitor books an appointment (HHS). That is why Curve Compliance, which signs a BAA on every plan, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

What does PHI stand for?

PHI is short for protected health information, the term HIPAA's Privacy, Security and Breach Notification Rules use for the health information they protect (HHS). You will also see PHI expanded as personal health information, but the HIPAA regulations define protected health information (45 CFR 160.103). As a medical abbreviation in US healthcare, PHI means this HIPAA term; in math, phi is a Greek letter. ePHI is the electronic part of PHI; see what ePHI is.

Protected health information definition, word for word

The definition sits in 45 CFR 160.103: "Protected health information means individually identifiable health information" that is "(i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium." The same section defines individually identifiable health information as "information that is a subset of health information, including demographic information collected from an individual," that passes three tests:

• It comes from a health source. It "Is created or received by a health care provider, health plan, employer, or health care clearinghouse" (45 CFR 160.103).
• It is about health, care or payment. It "Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual" (45 CFR 160.103).
• It points to a person. It identifies the individual, or there is "a reasonable basis to believe the information can be used to identify the individual" (45 CFR 160.103).

HIPAA protects that information when a covered entity or its business associate holds it. HHS says the Privacy Rule "protects all 'individually identifiable health information' held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral" (HHS).

What makes health information identifiable

HHS says identifiable health information "includes many common identifiers (e.g., name, address, birth date, Social Security Number)" (HHS). The 18 identifiers in 45 CFR 164.514(b)(2)(i) are the list a covered entity removes to de-identify data under the Safe Harbor method. They are a checklist, not the definition itself; the 18 HIPAA identifiers covers each one and where it shows up in website data.

An identifier on its own is not automatically PHI. HHS says "Identifying information alone, such as personal names, residential addresses, or phone numbers, would not necessarily be designated as PHI," as in a public phone book, but the same details "listed with health condition, health care provision or payment data" would be (HHS).

PHI or not: six quick cases

The table applies the definition to common records, with the source behind each answer.

Example	PHI?	Why
A medical record, lab report or hospital bill	Yes	HHS says each "would contain a patient's name and/or other identifying information associated with the health data content" (HHS).
An appointment booked on a covered clinic's website and sent to a tracker	Yes	HHS says the tracking vendor that receives the appointment details and IP address is a business associate, "and a BAA is required" (HHS).
A name and phone number in a public phone book	No	Nothing ties it to health, care or payment (HHS).
A health plan report of members' average age	No	It "does not identify any individual plan members" (HHS).
A hospital's HR file on one of its own employees	No	Employment records a covered entity holds as an employer are excluded (45 CFR 160.103).
Data de-identified under Safe Harbor or Expert Determination	No	HHS says it "is no longer considered protected health information" (HHS).

For 30 more data types, from initials and ZIP codes to cookies and ad click IDs, see examples of PHI: 30 data types answered.

What is not PHI

• Four kinds of records are excluded. The definition leaves out information "In education records covered by the Family Educational Rights and Privacy Act," certain other records described in that law, information "In employment records held by a covered entity in its role as employer," and information "Regarding a person who has been deceased for more than 50 years" (45 CFR 160.103).
• De-identified data. HHS names "two methods that can be used to satisfy the Privacy Rule's de-identification standard: Expert Determination and Safe Harbor" (HHS), and says "There are no restrictions on the use or disclosure of de-identified health information" (HHS). See de-identified vs anonymized data.
• Health data no covered entity or business associate holds. HHS says "the protections of the Privacy Rule apply to information held by covered entities and their business associates" (HHS). Other laws can apply instead; FTC breach notification provisions "apply to vendors of personal health records and their third party service providers" (HHS). See the FTC Health Breach Notification Rule.

PHI vs ePHI vs PII

ePHI, electronic protected health information, is PHI "Transmitted by electronic media" or "Maintained in electronic media" (45 CFR 160.103). The Security Rule protects ePHI only. HHS says "Unlike the Privacy and Breach Notification Rules, the Security Rule does not apply to PHI that is maintained or transmitted on paper or verbally" (HHS). See what ePHI is.

PII, personally identifiable information, is not a term HIPAA's definitions use; HIPAA turns on individually identifiable health information. For how the two overlap in marketing data, see PHI vs PII.

Who must protect PHI

HIPAA applies to covered entities: "(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" (45 CFR 160.103). HHS adds that "Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction" (HHS). Business associates create, receive, maintain or transmit PHI for a covered entity, and the covered entity needs a business associate agreement with each one. See what a covered entity is, what a business associate is and what a BAA is.

PHI on websites and in ad tracking

HHS's guidance on tracking technologies says "Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules." In its booking example, a covered clinic's website sends appointment details and the visitor's IP address to a tracking vendor, and "In this case, the tracking technology vendor is a business associate, and a BAA is required" (HHS).

On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated part of that guidance: HHS says the court vacated it "to the extent it provides that HIPAA obligations are triggered in" cases where a technology connects "(1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers," and that "HHS is evaluating its next steps in light of that order" (HHS). The rest of the guidance is still posted. For what is considered PHI on a website, data point by data point, see what counts as PHI on a website and the annotated bulletin.

Start with the free Curve Compliance website scan, which lists the pixels and trackers on a page. Then check booking, intake and contact forms and thank-you pages. Which rules apply to your site depends on your facts, so talk to your counsel. For a second pair of eyes, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. See how Curve's PHI detection works.

Curve collects this data under the BAA it signs on every plan (BAA Directory entry), and Curve is SOC 2 Type II. Curve Forms hosts intake and lead forms under the same BAA, with ad attribution attached. Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 160.103; 45 CFR 164.514; HHS, summary of the HIPAA Privacy Rule; HHS, summary of the HIPAA Security Rule; HHS, guidance on de-identification of protected health information; HHS, use of online tracking technologies by HIPAA covered entities and business associates; HHS, Breach Notification Rule; HHS, HIPAA Security Rule NPRM; HHS, fact sheet on the 42 CFR Part 2 final rule; HHS, regulatory initiatives.

Frequently Asked Questions

What does the acronym PHI stand for in a healthcare setting?

Protected health information, the HIPAA term for identifiable health information that covered entities and their business associates must protect (45 CFR 160.103). Its electronic form is called ePHI.

What is PHI in simple terms?

PHI is information about a person's health, care or payment for care that identifies them, or could reasonably be used to, held by a HIPAA covered entity or its business associate (45 CFR 160.103). It covers electronic, paper and spoken information alike.

What does PHI mean in HIPAA?

In HIPAA, PHI means individually identifiable health information that is transmitted or maintained in electronic media or "any other form or medium," apart from four excluded kinds of records (45 CFR 160.103).

What are the three types of PHI?

HIPAA does not name types of PHI, but its definition has three parts: PHI "(i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium" (45 CFR 160.103). In practice that means electronic, paper and spoken information.

Which of the following is Protected Health Information?

A medical record, a lab report, a hospital bill or a clinic's list of patients is PHI; a phone book listing, or the average age of a health plan's members, is not (HHS). The test is whether the information identifies a person, relates to their health, care or payment, and is held by a covered entity or business associate.

What does PHI not cover?

PHI excludes education records covered by FERPA and certain related records, employment records a covered entity holds as an employer, and information about a person "deceased for more than 50 years" (45 CFR 160.103). De-identified data is not PHI either (HHS).

What are the three HIPAA rules to protect PHI?

The Privacy Rule, the Security Rule and the Breach Notification Rule. HHS says "Together, the Privacy, Security, and Breach Notification Rules help to protect the privacy and security of protected health information (PHI)" (HHS).

What is the new HIPAA rule in 2026?

There is no single new rule. For updated notices of privacy practices, HHS says "Compliance with the remaining NPP modifications is required by February 16, 2026" (HHS), and the 42 CFR Part 2 final rule has the same date (HHS). HHS's Security Rule update, issued December 27, 2024, is still a proposed rule, and HHS says "the current Security Rule remains in effect" (HHS). See the new HIPAA rule in 2026 and Part 2 and marketing.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.