Protected Health Information (PHI) is defined as individually identifiable health information transmitted or maintained by a covered entity or its business associates in any form or medium (45 CFR 160.163). PHI is information, including demographic information, which relates to the individual's past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual.
18 PHI Identifiers
- Names
- Geographic subdivisions smaller than a state, including street address, city, county,
precinct, zip code, and their equivalent codes, except the three digits of a zip
code if the geographic unit formed by combining all the zip codes with the same three
initial digits contains more than 20,000 people and the initial digits of a zip code
for all such geographic units containing 20,000 or fewer people is changed to 000
geographical - All the elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, and date of death and all ages over 89 and all elements of dates (including year) indicative of such age (except that such ages and elements may be aggregated into a single category of age 90 or older)
- Telephone numbers
- Fax numbers
- Electronic mail addresses
- Social Security numbers
- Medical records numbers
- Health plan beneficiary members
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers, including license plate numbers
- Device identifiers and serial numbers
- Web Universal Resources Locators (URLs)
- Internet Protocol (IP) address numbers
- Biometric identifiers, including finger and voice prints
- Full face photographic images and any comparable images
- Any other unique identifying number, characteristic, or code (excluding a random identifier
code for subject that is not related to or derived from any existing identifier)
For more information, see: www.hhs.gov/hipaa/for-professionals/index.html