On this page
Short answer: PHI (protected health information) is health information that can be tied to a specific person and is created, received, kept or sent by a HIPAA covered entity (a health plan, a clearinghouse, or a provider that bills electronically) or by a vendor working for one. Health information becomes PHI when it sits next to an identifier: a name, an address smaller than a state, any date except the year, a phone number, an email address, a medical record, account or claim number, an IP address, a photo of a face, and the rest of HIPAA's list of 18. Remove all 18 (or have an expert certify the risk is very small) and the data is de-identified, which is no longer PHI. This guide gives the definition, the full list, quick answers to the questions people actually search, examples, and what changes when the PHI lives in an app you build.
Building a healthcare app? Describe it — we’ll build it now.
We started the prompt for you. Edit it, or describe your own app.
What PHI means #
HIPAA defines protected health information in 45 CFR 160.103 as individually identifiable health information, in any form or medium, held or transmitted by a covered entity or a business associate. Three things have to be true at once:
- It is about health, care or payment. A person's past, present or future physical or mental health, the care they received, or the payment for that care.
- It identifies the person, or could reasonably be used to. Directly (a name) or indirectly (a member number, a date of service plus a ZIP code).
- A covered entity or business associate holds or sends it. The same fact in a personal diary or a consumer fitness app is not PHI under HIPAA, although other privacy laws may cover it.
Form does not matter. A printed discharge summary, a voicemail about a test result and a row in a database are all PHI. ePHI is simply PHI in electronic form, and it is what the HIPAA Security Rule is written about.
Who HIPAA applies to #
- Covered entities. Health plans, health care clearinghouses, and health care providers that send standard transactions (such as claims) electronically.
- Business associates. Vendors and subcontractors that create, receive, maintain or transmit PHI on a covered entity's behalf: billing companies, IT and hosting providers, software platforms, consultants. A business associate signs a Business Associate Agreement (BAA) and is directly liable for parts of the Security Rule.
If an organisation is neither, HIPAA usually does not apply to its data. That is why the same blood pressure reading can be PHI in a clinic's system and not PHI in a wellness app the patient downloaded on their own.
The 18 HIPAA identifiers #
The list comes from the Safe Harbor de-identification method in 45 CFR 164.514(b)(2). Data counts as de-identified under Safe Harbor only when all 18 are removed, for the patient and for their relatives, employers and household members, and you have no actual knowledge that what is left could identify the person.
| # | Identifier | Notes |
|---|---|---|
| 1 | Names | Full names, last names, initials combined with other details |
| 2 | Geographic units smaller than a state | Street address, city, county, precinct, ZIP code. The first three ZIP digits may stay if that three-digit area has more than 20,000 people; otherwise use 000 |
| 3 | All elements of dates except the year | Birth, admission, discharge and death dates, dates of service. Ages over 89 become a single "90 or older" category |
| 4 | Telephone numbers | Home, mobile and work numbers |
| 5 | Fax numbers | Still common in referrals and records requests |
| 6 | Email addresses | Personal or work addresses |
| 7 | Social Security numbers | Full numbers |
| 8 | Medical record numbers | MRNs |
| 9 | Health plan beneficiary numbers | Member and subscriber IDs |
| 10 | Account numbers | Patient billing accounts |
| 11 | Certificate and license numbers | Driver's licence, professional licence |
| 12 | Vehicle identifiers and serial numbers | Including licence plates |
| 13 | Device identifiers and serial numbers | Implants, monitors, phones tied to a patient |
| 14 | Web URLs | A personal page or a URL that contains a patient identifier |
| 15 | IP addresses | Logged by portals, websites and email systems |
| 16 | Biometric identifiers | Fingerprints, voiceprints |
| 17 | Full-face photographs and comparable images | Including images in records and on badges |
| 18 | Any other unique identifying number, characteristic or code | Claim numbers, accession numbers, case numbers, study IDs that can be traced back. A re-identification code you create under the rule's conditions is the exception |
Is it PHI? Quick answers #
Each answer assumes the data is held by a covered entity or business associate. Outside that setting, HIPAA does not apply to it.
| Item | Answer | Why |
|---|---|---|
| Claim number | Yes, when it is tied to a patient's care or payment | It is a unique number that points to one person's claim: an account number or "any other unique identifying number" on the list |
| Accession number (lab or imaging) | Yes, when it is tied to a patient | It identifies a specimen or study that belongs to one person (identifier 18) |
| Medical record number | Yes | Named on the list (identifier 8) |
| IP address | It can be | On the list (identifier 15). Logged next to a patient portal login or an appointment request, treat it as PHI |
| ZIP code | It can be | Smaller than a state, so it is an identifier. Safe Harbor lets you keep three digits only for areas over 20,000 people |
| Year of birth | Not on its own | The year is allowed; the month and day are not. Ages over 89 must be grouped as 90 or older |
| A patient's name on an appointment list | Yes | The fact that someone is a patient of a given provider is information about their care |
| Diagnosis, lab result or scan with no identifiers | Not if it is properly de-identified | Health data alone is not PHI once all 18 identifiers are gone and nothing left points to the person |
| Staff records in a hospital's HR file | No | Employment records a covered entity holds as an employer are excluded from the definition |
| A student's health record at a school | Usually no | Education records covered by FERPA are excluded from the definition |
| Records of someone who died more than 50 years ago | No | Excluded from the definition |
PHI examples #
- Care. A treatment plan with the patient's name, date of birth, diagnosis and medications; a discharge summary with dates of service; an imaging file with the MRN or accession number in its metadata.
- Billing and insurance. A claim with the subscriber ID and procedure codes; an Explanation of Benefits; a payment plan tied to a patient account.
- Communication. A voicemail confirming a test result; an appointment reminder text that names the specialty; an email thread about a referral.
- Software. Patient portal logs with usernames and IP addresses; telehealth recordings and transcripts; support tickets where staff pasted clinical or billing details; exports and PDFs generated from any of the above.
The last group is where PHI tends to leak: the database is protected, and then a notification email, a CSV export or a screenshot in a support ticket carries the same information somewhere that is not.
PHI vs ePHI vs PII vs an EHR #
| Term | What it is | Under HIPAA? |
|---|---|---|
| PHI | Identifiable health, care or payment information, in any form | Yes, when a covered entity or business associate holds it |
| ePHI | PHI in electronic form | Yes, and the Security Rule's safeguards are written for it |
| PII | Any information that identifies a person, health-related or not | Only when it is also PHI |
| EHR | An electronic health record system | The system is not PHI; the records in it are |
De-identified data and limited data sets #
HIPAA recognises two ways to de-identify PHI. De-identified data is not PHI, so the Privacy Rule no longer restricts its use.
- Safe Harbor (45 CFR 164.514(b)(2)). Remove all 18 identifiers, apply the ZIP code and age-over-89 rules, and have no actual knowledge that the rest could identify the person.
- Expert Determination (45 CFR 164.514(b)(1)). A qualified expert applies statistical or scientific methods, concludes that the risk of re-identification is very small, and documents the methods and results. This route can keep more detail, such as dates, when the expert's analysis supports it.
| PHI | De-identified under Safe Harbor |
|---|---|
| Jane Doe, born 10/ | Adult patient, born 1981, MRI of the left knee in 2025 |
| ZIP 02138, portal login from 203.0.113.7, cardiology appointment request | Three-digit ZIP area (if over 20,000 people), 2025, cardiology appointment request |
How to keep PHI where it belongs #
| Safeguard | What it means in practice | How often |
|---|---|---|
| Risk analysis | List where ePHI lives and moves, what could go wrong, and what you do about it | Once a year and whenever a system, vendor or workflow changes |
| Access control | A login per person, roles that show each person only what their job needs, fast offboarding | Review access every quarter |
| Audit trail | Record who read or changed which record, when and from where | Review monthly; keep it exportable for investigations |
| Encryption | In transit for every connection; at rest for the database, files and backups | Check when infrastructure changes |
| Vendors | A signed BAA with every vendor that stores or sends PHI for you, including email and SMS services | Review the list once a year |
| Notifications and exports | Say that something is waiting and link to it; do not put PHI in email bodies, texts or ad-hoc spreadsheets | Check every new workflow |
| Tracking technologies | Keep analytics pixels and session recorders off logged-in patient pages | Inventory every quarter |
| Training and incident response | Staff know what PHI is and how to report a mistake; you have rehearsed a breach | Once a year at least |
On tracking: HHS's Office for Civil Rights published guidance on online tracking technologies in 2022 and updated it in 2024. A federal court vacated the part that covered visits to public, unauthenticated web pages in June 2024; logged-in portal pages were not part of that ruling. Check the HHS page for the current status before you decide what your public site may load.
When the PHI lives in an app you build #
Clinics and care teams increasingly build their own intake, case management and scheduling apps instead of stretching spreadsheets and form tools. The 18 identifiers are then mostly fields in your tables, so the questions become concrete: which tables and fields hold PHI, which role can read each one, where a notification or export could copy it out, and whether every vendor on the path signs a BAA.
Tadabase AI is HIPAA-eligible: on HIPAA-eligible plans we sign a BAA and run your app on BAA-covered AWS infrastructure. This is what the product does for the questions above.
- PHI classification down to the field. You flag which tables and fields hold PHI, so a member ID or a diagnosis is marked where it is stored.
- Row-level security enforced on the server. Record rules and roles are applied where the data is read, so the same rule covers pages, the API, and the AI-generated React front end. A front desk sees its own clinic; a patient sees only their own records.
- A PHI access log. On HIPAA-eligible plans, reads and changes of PHI are recorded with the user, the action, the table and record, the source IP and the result. Values are never written to the log, and exporting the log is restricted to trusted roles.
- Secure file fields for uploads such as insurance cards and imaging, opened only by a logged-in, authorised user.
- Security settings applied by HIPAA setup. Automatic logoff, two-factor authentication for end users and a password policy are set when you turn HIPAA on, per app, including on an app you have already built.
- A publish gate. A HIPAA-flagged app is checked before every publish: PHI tables flagged, deny-by-default row-level security on them, secure file fields, access logging on, BAA-covered hosting. A configuration that fails cannot go live.
- The AI works on stand-ins. On a HIPAA app the in-app agent sees consistent pseudonyms in place of real PHI, its reads are logged separately from a person's reads, and it refuses to push PHI through side channels such as exports, reports and PDFs.
HIPAA stays a shared responsibility. The platform supplies technical controls and the BAA; your organisation still owns the risk analysis, policies, training and the decision about who gets which role.
Common questions #
What does PHI stand for? Protected health information: health, care or payment information that identifies a person and is held or sent by a HIPAA covered entity or business associate.
What are the 18 PHI identifiers? Names; geographic units smaller than a state; all date elements except the year (and ages over 89); phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face photos; and any other unique identifying number, characteristic or code.
Is a claim number considered PHI? Yes, when a covered entity or business associate holds it alongside the claim. A claim number points to one person's care and payment, so it falls under account numbers or "any other unique identifying number" on the Safe Harbor list.
Is an IP address PHI? It can be. IP addresses are identifier 15. When an IP address is recorded next to a portal login, an appointment request or other health interaction in a covered entity's systems, treat it as PHI.
What is the difference between PHI and ePHI? PHI is protected health information in any form, including paper and speech. ePHI is the electronic subset, and the HIPAA Security Rule's safeguards apply to it.
Is de-identified data still PHI? No, if it was de-identified by Safe Harbor or Expert Determination. A limited data set, which keeps dates and ZIP codes, is still PHI.
Can a software vendor see our PHI? Only under a Business Associate Agreement that limits what it may do with the data. Ask every vendor that stores or sends PHI for you to sign one before real patient data goes in.
Where to start #
Take the 18 identifiers and walk your own systems: every table, form, export, notification and log that holds one of them next to health information is PHI and needs an owner, a role and a BAA behind it. The HIPAA checklist on this blog covers the rest of compliance step by step, and the patient intake guide shows the same rules applied to forms. To build the app itself, the healthcare page at tadabase.com/healthcare shows the Compliance Center and the publish gate. Every account starts with a 14-day free trial; talk to us about a HIPAA-eligible plan before real patient data goes in.