The PHI medical abbreviation stands for protected health information, which is any health information that can be tied to a specific person and is held by a health care provider, health plan or one of their business partners. It is a legal term from the privacy rules under HIPAA, the federal health privacy law in the United States.
Patients meet it on privacy notices and consent forms. Staff and students meet it in training on day one, because nearly every job in health care touches PHI. This page explains what counts, what does not, the related term ePHI, and everyday habits that keep it safe.
At a glance
Stands for
Protected health informationLegal home
HIPAA Privacy Rule (United States)Digital form
ePHI, electronic protected health informationWhere you see it
Privacy notices, staff training, record release formsOther meaning
Personal health information, used in some Canadian privacy lawsStored in
PHI medical terminology in plain terms
Health information becomes PHI when two things are true. First, it relates to a person's past, present or future physical or mental health, the care they received, or payment for that care. Second, it identifies the person or could reasonably be used to identify them. A blood pressure reading on its own is just a number. The same reading next to a name, a date of birth or a record number is PHI.
The rule covers health care providers that bill electronically, health plans, and clearinghouses, along with the business associates that handle data for them, such as billing or transcription services. It applies in every form: paper, spoken and electronic.
Common identifiers that turn data into PHI
The privacy rule lists 18 kinds of identifiers. When all of them are removed under its de-identification method, the data is no longer treated as PHI. A selection is below.
| Type | Examples |
|---|---|
| Names and contact details | Name, street address, phone number, email address |
| Dates linked to a person | Birth date, admission date, discharge date, date of death |
| Numbers | Social Security number, medical record number, health plan number, account number |
| Images and biometrics | Full face photos, fingerprints, voice prints |
| Device and online data | Device serial numbers, IP addresses, web addresses |
What PHI covers and what it does not
Lab results, imaging reports, diagnoses, medicine lists, therapy notes, appointment times and bills are all PHI when linked to a person. So is the simple fact that someone is a patient at a particular clinic.
Some health data falls outside the definition. Employment records a company keeps as an employer, school records covered by education privacy law, and data in many consumer fitness or wellness tools that are not run by a covered health organization are generally not PHI under this rule, even though other laws may protect them. Fully de-identified data is not PHI either.
Handling rules behind the PHI medical abbreviation
Training programs teach a minimum necessary approach: use or share only the PHI needed for the task. A few habits follow from that.
- Log out or lock the screen when you step away from a workstation.
- Do not discuss patients in elevators, cafeterias or on social media, even without a name.
- Send records only through approved secure channels.
- Shred paper that contains identifiers rather than placing it in regular trash.
- Look only at the charts you need for your role.
Clinical student orientation: "Remove all PHI from care plans before submitting." Students replace the patient's name, record number and dates with initials or neutral labels before turning in coursework.
Your rights over your own PHI
Under the privacy rule, patients may inspect and obtain copies of most records held about them, request corrections, receive an accounting of certain disclosures, and request limits on some sharing. Providers must give a notice of privacy practices that explains how they use PHI. A request for records usually goes to the health information or medical records department, often through a signed release form.
Providers may share PHI without separate permission for treatment, payment and health care operations, and in certain public health and legal situations.
Frequently asked questions
What is the PHI acronym in medical settings?
PHI stands for protected health information. It means identifiable information about a person's health, care or payment for care that is held by a covered health organization or its business associates.
Is my name alone considered PHI?
A name by itself in a phone book is not PHI. A name held by a clinic together with the fact that you are a patient, or with any health detail, is PHI.
What is the difference between PHI and ePHI?
ePHI is protected health information that is created, stored or sent electronically. It falls under extra security rules covering things like access controls and encryption.
Can a doctor share my PHI with another doctor?
Yes, sharing for treatment is generally allowed without a separate signed permission. Many other uses, such as most marketing, need written authorization from the patient.
What should a student do if they see PHI by accident?
Stop looking, do not share it, and tell an instructor or supervisor if it was in the wrong place. Facilities have a process for reporting possible privacy problems.