Compliance Glossary

Welcome to our list of commonly used security and compliance terms.

  • Glossary
  • Protected Health Information (PHI)

PHI stands for Protected Health Information. 

PHI is protected under the Health Insurance Portability and Availability Act (HIPAA), and includes any health data created, transmitted, or stored by a HIPAA-covered entity and its business associates. It includes electronic records (ePHI), written records, lab results, x-rays, bills — even verbal conversations that include personally identifying information. 

PHI is protected by the HIPAA Privacy Rule, which requires covered entities and their business associates to establish safeguards to maintain the security and confidentiality of protected health information. 

The US Department of Health and Human Services (HHS) defines 18 key identifiers that determine whether the information is classified as PHI:

  • Names
  • Identifying geographic information, including addresses or ZIP codes
  • Dates (except for the year) that relate to birth, death, admission, or discharge
  • Telephone numbers
  • Fax numbers
  • Email addresses
  • Social security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate numbers
  • Vehicle identifiers, such as license plates or VIN numbers
  • Device identifiers and serial numbers
  • Web addresses
  • IP addresses
  • Biometric data such as fingerprints or retina scans
  • Full face images
  • Any other information that could potentially identify an individual, including for current and planned medical situations like prognoses, treatment or rehabilitation plans, or mental health evaluations

Recommended Reading

What is PHI Under HIPAA? Requirements for Compliance

Read More

Join the thousands of companies using Secureframe