Overview#

Protected Health Information (PHI) is Protected Data, and is defined by HIPAA as:[1]

Protected Health Information generally, is PII as it relates to medical information.

Specific Identifiers#

Under the US Health Insurance Portability and Accountability Act (HIPAA), Protected Health Information that is linked based on the following list of 18 identifiers must be treated with special care:

1. Names - First Name, Last Name
2. All geographical identifiers smaller than a state, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000
3. Dates (other than year) directly related to an individual
4. Phone Numbers
5. Fax numbers
6. Email Address
7. Social Security Numbers
8. Medical record numbers
9. Health insurance beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers, including License Plate Numbers;
13. Device identifiers and serial numbers;
14. Web Uniform Resource Locators (URLs)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers, including finger, retinal and voice prints
17. Full face photographic images and any comparable images
18. Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data

De-Identified Health Information #

PHI is used in datasets by researchers share the dataset publicly. When researchers remove Protected Health Information from a dataset they do so in an attempt to preserve privacy for research participants. This is defined as:[1]

Permitted Uses and Disclosures[1] #

A HIPAA Covered Entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations:

1. To the Individual (unless required for access or accounting of disclosures);
2. Treatment, Payment, and Health Care Operations;
3. Opportunity to Agree or Object;
4. Incident to an otherwise permitted use and disclosure;
5. Public Interest and Benefit Activities;
6. Limited Data Set for the purposes of research, public health or health care operations. Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.

Read the official documentation for details.

A lot of Protected Health Information is also considered Personally Identifiable Information by most parties.

More Information#

There might be more information for this subject on one of the following:

• Data Classification
• Data anonymization
• Electronic Health Record
• Electronic Medical Record
• HIPAA Covered Entity
• Health Insurance Portability and Accountability Act
• Health information
• Identity Attributes
• PHI
• Patient Data
• Personal data
• Protected Data
• Web Blog_blogentry_280717_1
• Zero Trust

---

• [#1] - http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/ - based on 2013-04-19