What Is Protected Health Information (PHI) Under HIPAA?

Protected health information under HIPAA is any information about a person’s health, healthcare, or payment for healthcare that identifies them (or could reasonably be used to identify them) and is created, received, or held by a healthcare provider, health plan, healthcare clearinghouse, or one of their contractors. That three-part test, set out in 45 CFR 160.103, decides whether federal privacy and security rules apply to a given piece of data.¹ Everything else in HIPAA (how the data can be used, who can see it, what patients can demand, what happens when it leaks) flows from that definition.

The Three-Part Test for PHI

Data becomes PHI only when all three of these elements line up.

First, the information has to relate to health. That covers a past, present, or future physical or mental health condition, any healthcare a person receives, and any past, present, or future payment for that care. A diagnosis, a prescription, a lab result, a hospital bill, and a referral letter all fit. Since 2013, the definition expressly includes genetic information, including genetic tests of family members and the manifestation of disease in relatives.¹

Second, the information has to be identifiable. Naming the patient is the obvious case, but the standard also catches data that gives someone a reasonable basis to figure out who the patient is. A discharge summary that omits the name but describes a rare condition treated at a small rural hospital can still identify the patient by narrowing the field enough.

Third, a regulated organization has to be handling the data. The legal duties attach to the entity holding the information, not to the information in the abstract. If you tell a friend about your diagnosis or post your blood-pressure readings on social media, that same information is not PHI, because no covered entity or business associate is involved.

The 18 HIPAA Identifiers

The Privacy Rule lists 18 specific data elements that make health information identifiable. If even one appears alongside health data, the record is PHI and the full rule applies. The list, at 45 CFR 164.514, is also the checklist for de-identifying data.²

Names
Geographic data smaller than a state: street address, city, county, and zip code (the first three digits of a zip code can remain if the area covers more than 20,000 people)
Dates tied to the individual: birth, admission, discharge, death (year alone is permitted; all ages over 89 must be grouped as “90 or older”)
Phone numbers
Fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate or license numbers
Vehicle identifiers and serial numbers, including license plates
Device identifiers and serial numbers
Web URLs
IP addresses
Biometric identifiers, including fingerprints and voiceprints
Full-face photographs and comparable images
Any other unique identifying number, characteristic, or code that could reasonably identify the person

The eighteenth category is deliberately open-ended so organizations cannot sidestep the rule by inventing a new identifier that is not on the list.

Who Is Bound by HIPAA

Three types of organizations, called covered entities, bear direct responsibility for PHI: healthcare providers that transmit health information electronically in connection with certain standard transactions (claims, eligibility inquiries, referral authorizations, and similar exchanges), health plans (private insurers, HMOs, employer group plans, Medicare, Medicaid), and healthcare clearinghouses that translate nonstandard billing data into standardized electronic formats.³ Nearly every provider now meets the electronic-transaction threshold because electronic billing is universal.

Covered entities routinely share PHI with outside contractors: billing companies, IT vendors, cloud storage providers, law firms, accountants. Those contractors are business associates, and since the HITECH Act of 2009 they have been directly liable for HIPAA compliance rather than only through their contracts with the covered entity.⁴ Federal regulators can pursue them directly.

How PHI Can Be Used and Shared

The Privacy Rule permits covered entities to use and disclose PHI without written patient authorization for three core purposes: treatment, payment, and healthcare operations.⁵ Treatment covers coordination and delivery of care, including consultations and referrals. Payment covers billing, claims processing, eligibility determinations, and medical-necessity reviews. Operations covers quality assessment, credentialing, fraud detection, and internal business functions.

Some other disclosures are allowed without authorization, including public health reporting, judicial proceedings with proper orders, law enforcement requests that meet specific criteria, and organ donation coordination. But marketing communications, the sale of PHI, and most disclosures of psychotherapy notes always require the patient’s written authorization.⁶

The Minimum Necessary Standard

Covered entities cannot share an entire medical record when a smaller slice would do. The minimum necessary standard requires reasonable efforts to limit PHI disclosures to only what is needed for the specific purpose. An insurer processing a knee-surgery claim does not need the patient’s psychiatric history. The standard does not apply to disclosures between providers for treatment, disclosures directly to the patient, uses the patient authorized in writing, disclosures required by law, or disclosures to HHS during a compliance investigation.⁷

Reproductive Health Care Protections

A 2024 final rule prohibits using or disclosing PHI to investigate or impose liability on anyone for seeking, obtaining, providing, or facilitating reproductive health care that was lawful where it was provided.⁸ It covers contraception, prenatal care, miscarriage management, fertility treatment, and pregnancy termination. Covered entities and business associates have been required to comply since December 23, 2024, and must describe the prohibition in their Notice of Privacy Practices.

Your Rights Over Your PHI

HIPAA gives patients several enforceable rights, and HHS has run a dedicated Right of Access initiative producing dozens of settlements against providers that stalled on records requests.⁹

Access to Your Records

You can inspect and get a copy of your PHI held in a designated record set. The entity must act within 30 days, with one possible 30-day extension supported by a written explanation.¹⁰ If the records are electronic and you request an electronic copy, the entity must provide the format you asked for if it can reasonably do so. Fees are limited to reasonable, cost-based amounts; for electronic copies of electronic records, entities can use an optional flat fee of $6.50 instead of calculating actual costs, though that figure is not a universal cap on all copy fees.¹¹ Psychotherapy notes and information compiled for litigation are generally excluded.

Amendments

If you believe your records contain an error, you can request an amendment. The entity has 60 days to act, with one 30-day extension.¹² It can deny the request if the record is accurate and complete, if it did not create the record, or if the information is not part of the designated record set. On denial, you can file a statement of disagreement that travels with the record.

Restrictions on Disclosure

You can ask a covered entity to restrict how it uses or discloses your PHI for treatment, payment, or operations, and it is usually free to say no. One situation is mandatory: if you paid for a service entirely out of pocket and ask the provider not to disclose that information to your health plan, the provider must honor that restriction unless the disclosure is otherwise required by law.¹³

Accounting of Disclosures

You can request a log of disclosures a covered entity has made over the prior six years. Disclosures for treatment, payment, and operations generally do not have to appear, but disclosures to public health authorities, law enforcement, and other third parties do.¹⁴

What Does Not Count as PHI

Several categories of health-adjacent data sit outside HIPAA, and the distinctions trip people up.

De-identified data. Health information stops being PHI once it has been properly de-identified, either by removing all 18 identifiers and confirming no actual knowledge that the remainder could identify anyone (the safe harbor method), or by having a qualified statistician certify that the re-identification risk is very small (the expert determination method).¹⁵ Properly de-identified data can be shared freely.

Employment records. Records held by a covered entity acting as an employer are excluded from PHI, even when they contain health information. Sick leave logs, drug test results, workers’ compensation paperwork, and return-to-work evaluations in a personnel file are governed by employment law and company policy, not the Privacy Rule.¹⁶

Education records. Student health records that qualify as education records under FERPA are exempt from HIPAA, even when kept by a campus health clinic. FERPA has its own privacy framework.¹⁷

Records of people deceased more than 50 years. PHI protections remain in force for 50 years after death, during which a personal representative can exercise the individual’s rights. After that, the information is no longer PHI.¹⁸

Consumer health apps and fitness trackers. Data collected by consumer fitness trackers and wellness apps is generally not PHI when the developer is not a covered entity or business associate. Privacy depends on the company’s terms and applicable consumer protection laws. The same heart-rate reading is PHI in your cardiologist’s electronic health record and not PHI on a smartwatch maker’s servers.

What Happens When PHI Is Breached

When unsecured PHI is accessed, used, or disclosed in a way the Privacy Rule does not permit, the Breach Notification Rule applies. Covered entities must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovering the breach. The notice must describe what happened, what information was involved, what the individual should do, and what the entity is doing to investigate and prevent a repeat.¹⁹

Reporting obligations scale with size. Breaches affecting 500 or more people in a single state or jurisdiction also require notice to prominent local media outlets, and must be reported to the HHS Secretary within 60 days of discovery.¹⁹ Smaller breaches can be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered.²⁰

Penalties for HIPAA Violations

Civil penalties are structured by the violator’s level of fault and adjusted annually for inflation. The 2026 tiers, published in the Federal Register, are:²¹

Tier 1, did not know: $145 to $73,011 per violation, calendar-year cap of $2,190,294
Tier 2, reasonable cause: $1,461 to $73,011 per violation, same annual cap
Tier 3, willful neglect corrected within 30 days: $14,602 to $73,011 per violation, same annual cap
Tier 4, willful neglect not corrected: $73,011 to $2,190,294 per violation, same annual cap

Each affected record can count as a separate violation, so a single breach involving thousands of patients can produce enormous exposure. Criminal penalties apply when someone knowingly obtains or discloses PHI in violation of the law, in three tiers:²²

Knowing violation: up to $50,000 in fines and one year in prison
Under false pretenses: up to $100,000 and five years
Intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm: up to $250,000 and ten years

Criminal prosecution is uncommon compared to civil enforcement, and the top penalties usually involve insiders who access records out of curiosity or sell patient information for profit.

1
eCFR. 45 CFR 160.103 – Definitions
2
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
3
U.S. Department of Health and Human Services. Covered Entities and Business Associates
4
U.S. Department of Health and Human Services. Direct Liability of Business Associates
5
U.S. Department of Health and Human Services. Uses and Disclosures for Treatment, Payment, and Health Care Operations
6
U.S. Department of Health and Human Services. Model Notice of Privacy Practices for HIPAA Covered Health Care Provider
7
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information – General Rules
8
Federal Register. HIPAA Privacy Rule To Support Reproductive Health Care Privacy
9
U.S. Department of Health and Human Services. Five Enforcement Actions Hold Healthcare Providers Accountable
10
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
11
U.S. Department of Health and Human Services. Clarification of Permissible Fees for HIPAA Right of Access
12
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
13
eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information
14
eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information
15
U.S. Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information
16
U.S. Department of Health and Human Services. Employers and Health Information in the Workplace
17
U.S. Department of Education Student Privacy Policy Office. Know Your Rights – FERPA Protections for Student Health Records
18
U.S. Department of Health and Human Services. Health Information of Deceased Individuals
19
U.S. Department of Health and Human Services. Breach Notification Rule
20
U.S. Department of Health and Human Services. Submitting Notice of a Breach to the Secretary
21
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
22
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information