Any health information that is identifiable to an individual, which a healthcare provider, health plan, or any of their business associates create, receive, store, or send, regardless of what form it takes. PHI includes things like clinical details, names, dates, contact information, and insurance credentials.
Also called: PHI, ePHI (electronic PHI), patient health information
What counts as PHI?
Information can be considered PHI whenever it relates to a patient’s
- Care
- Health
- Payment
- Identifying information
PHI that is commonly handled during patient access tasks include details like:
- Appointment details
- Call recordings or notes
- Insurance information
- Intake forms
- Referral records
What isn’t PHI?
- De-identified data: Health information where any personally identifiable information has been redacted, making it nearly impossible to re-link it to the original patient
- Health info in employment records: When an employer collects certain health information (like notes for sick leave, Family and Medical Leave Act or FMLA certifications, ADA-related accommodation requests, results from drug tests, and records for worker’s compensation), it is viewed differently by HIPAA, since the data didn’t originate from a healthcare context. These details are still regulated and considered confidential, but they aren’t under the scope of HIPAA.
Click here for official HHS guidance on HIPAA standards and PHI
What is ePHI?
ePHI is PHI in any electronic form. The safeguards outlined by HIPAA’s Security Rule (administrative, physical, and technical) apply specifically to ePHI.
PHI in patient access outsourcing
A patient access team handles PHI on most calls. For that reason, any partner that works with patient access will also need to be HIPAA-compliant. To handle PHI in a [HIPAA-compliant] [Link to HIPAA Handoff page] manner, each partner should:
- Have a signed Business Associate Agreement (BAA)
- Be granted the minimum amount of access to PHI necessary to carry out their work
- Handle PHI only through secure systems and with secure practices
- Prove that their staff has up-to-date and documented HIPAA training, both on the team and individual levels
Risks and common mistakes
- PHI shared by unsecured email or text: PHI should only be stored or shared through secured channels to avoid making it vulnerable to outside threats.
- Shared logins: Without unique login credentials, it’s more difficult to track who’s accessing PHI and when, and data breaches become more likely.
- Notes outside of EMR: When healthcare notes are kept in unsecured locations outside of the EMR, it creates an unnecessary risk for data breaches.
- Lack of role-based access: Staff should only have the minimum necessary amount of access they need to do their work in their specific role. More access to PHI than necessary exposes PHI to more people, making it less secure.
Related terms
- Business Associate Agreement (BAA): A contract between a healthcare organization and any subcontractor that handles their PHI, ensuring they stay compliant with HIPAA.
- Minimum necessary standard: A HIPAA standard that requires healthcare providers and their associates to only use or access the minimum amount of PHI needed for their specific tasks.
- HITRUST certification: An optional certification that shows an organization is compliant with HIPAA.
- Role-based access: Access to PHI that is proportional and scoped to the role of those working with it and the specific tasks they are working on.
FAQs
Is a patient’s name alone PHI?
No. A patient’s name is PHI, but so are any other pieces of information about a patient regarding their care, health, payment, or personal info directly traceable to them. This includes, but is not limited to, info like health conditions, appointment details, call recordings and notes, insurance info, intake forms, referral records, and more.
Are call recordings PHI?
Yes. When connected to a patient’s health, care, or payment, call recordings are considered PHI.
Who is responsible for protecting PHI when work is outsourced?
All parties across the chain of compliance are responsible for protecting PHI, including the covered entities (healthcare providers), their business associates, and any subcontractors dealing with the PHI.
Note: This is general information, not legal advice. Click here for official HHS guidance on HIPAA standards and PHI.
