HIPAA basics
Is this data PHI? A working test for product teams.
Every HIPAA duty hangs on one label. If a record is protected health information (PHI), the Privacy, Security and Breach Notification Rules follow it wherever it goes. If it is not, HIPAA has nothing to say about it, though other laws may. This page gives you a repeatable way to decide, with examples you can test your own data against.
Back to HIPAA services01 · Three tests
Three questions that decide the label
Who holds it, what it is about, and whether it points to a person.
The definition in 45 CFR 160.103 reads as a chain. Data is PHI only when all three links hold at once. Break any one and the label falls away.
- Who holds it. A covered entity (a health plan, a health care clearinghouse, or a provider that bills electronically for standard transactions) or a business associate acting for one. The same blood pressure reading in a consumer app that sells straight to the public is usually not PHI.
- What it is about. Past, present or future physical or mental health, the care someone received, or payment for that care. Demographic details collected alongside count too.
- Whether it identifies someone. It names the person, or there is a reasonable basis to believe it could be used to work out who they are.
Form does not matter
PHI can be spoken, printed or stored. Electronic PHI (ePHI) is the subset that is kept or sent in electronic media, and it is the only part the Security Rule governs. The Privacy Rule covers all of it.
02 · The 18 identifiers
The safe-harbor identifiers, grouped by kind
Remove all eighteen kinds, for the person and their relatives, employer and household.
The safe harbor method in 45 CFR 164.514(b)(2) lists eighteen kinds of identifier. Strip every one of them, and have no actual knowledge that what remains could still point to someone, and the data is de-identified: no longer PHI. Read as a list of eighteen they blur together, so we group them.
| Group | Identifiers in the group | What you may keep |
|---|---|---|
| Who the person is | Names; full-face photographs and comparable images; biometric identifiers such as finger and voice prints | Nothing from this group |
| Where they are | Street address, city, county, precinct, ZIP code and similar geocodes below state level | The state; the first three ZIP digits only if that area holds more than 20,000 people, otherwise 000 |
| When things happened | Every date element tied to the person other than the year: birth, admission, discharge, death | The year; ages over 89 folded into a single 90-or-older group |
| How to reach them | Phone numbers, fax numbers, email addresses | Nothing from this group |
| Numbers issued to them | Social Security, medical record, health plan beneficiary, account, certificate and licence numbers | A random study code that cannot be reversed |
| Things they own or use | Vehicle identifiers and plates; device identifiers and serial numbers | Device type or model, not the serial |
| Their online trace | Web URLs and IP addresses | Nothing from this group |
| Anything else unique | Any other number, trait or code that singles someone out | A re-identification code built as 164.514(c) allows |
The actual knowledge condition catches teams out. If you know that a rare diagnosis plus a year plus a state points to one public figure, the data is not de-identified, even with all eighteen kinds removed.
03 · Other routes
Expert determination and the limited data set
Two ways to use richer data when safe harbor strips too much.
Expert determination
A statistician signs off
- A person with suitable statistical and scientific skill judges the re-identification risk to be very small for the expected recipient
- The expert documents the method and the result
- Can keep fields safe harbor removes, such as full dates, if the analysis supports it
- Once done, the output is not PHI
Limited data set
Still PHI, with fewer identifiers
- Direct identifiers removed; town, state, ZIP and dates may stay
- Only for research, public health or health care operations
- Needs a data use agreement with the recipient
- Remains PHI, so the rules still apply
A data use agreement promises no re-identification, no contact with individuals, safeguards, and reporting of misuse.
04 · What is not PHI
Health data that sits outside the definition
The exclusions are narrow and tied to who holds the record and why.
- Employment records
- A hospital's file on its own nurse's sick leave, held as employer, is not PHI, even though the hospital is a covered entity.
- Education records
- Records covered by the Family Educational Rights and Privacy Act, such as a school nurse's log at a school subject to it.
- Long-deceased people
- Information about someone who died more than 50 years ago.
- De-identified data
- Data that passed safe harbor or expert determination.
- Consumer health data
- Health data a business collects for itself, outside any covered entity or business associate role. Other law may apply to it.
Data outside HIPAA is not data outside the law. State privacy statutes and the Federal Trade Commission can still reach consumer health apps.
05 · PHI or not?
PHI or not? Eight illustrative cases
Run each through the three tests and the exclusions.
| Illustrative dataset | PHI? | Why |
|---|---|---|
| A clinic's appointment list with names and times, synced to your scheduling SaaS | Yes | Covered entity data, held by you as its business associate; being a patient is itself health information |
| Application logs that record patient IDs and the endpoint called | Yes | A medical record number plus activity is identifiable and health-related |
| The same logs with patient IDs hashed using a salt you keep | Likely yes | A reversible or linkable code is not a safe-harbor code |
| Heart-rate data in a fitness app sold direct to consumers | Usually no | No covered entity or business associate holds it; other laws may |
| That fitness app's data after a hospital contracts you to monitor its patients | Yes | You now hold it for a covered entity |
| Aggregate counts of visits by state and year, no row-level data | No | No identifiers left, and no reasonable basis to identify |
| A hospital's HR file on an employee's fitness-for-duty exam | No | Held in its role as employer |
| A research extract with ZIP codes and admission dates under a data use agreement | Yes | A limited data set is still PHI |
06 · For developers
How an engineering team decides, field by field
Classify at the schema, not after the incident.
- Map the data flow. List every place a record from a covered entity enters, rests and leaves: databases, queues, logs, backups, analytics, support tools.
- Tag fields at the schema. Mark each column as identifier, health content or neither, using the eighteen kinds as the checklist.
- Treat joins as identification. A table with no names can still be PHI if a key links it to one that has them.
- Watch the side channels. Error traces, screenshots in tickets and model prompts often carry PHI no one meant to send.
- Write the decision down. Record why a dataset is or is not PHI, who decided and when. A reviewer will ask.
Sources: 45 CFR 160.103 (definitions of health information, individually identifiable health information, protected health information and electronic PHI); 45 CFR 164.514(a) to (e) (de-identification, re-identification codes, limited data sets); HHS guidance on de-identification methods under the Privacy Rule.
Questions about PHI
Is an email address on its own PHI?
Only when it sits with health context held for a covered entity.
An email address alone, in a newsletter list, is not health information. The same address in a clinic's patient portal, held by you as its vendor, is PHI because it identifies someone as a patient of that provider.
Does hashing or tokenising make data de-identified?
Not if the token can be reversed or linked back.
Safe harbor allows a code only when it is not derived from the person's information and cannot be translated back. A plain hash of a medical record number fails that test, and a token whose vault you control is still a key to the person. Tokenising reduces risk; it does not by itself remove the PHI label.
Can we train a model on de-identified data?
Yes, once the data truly meets a de-identification method.
De-identified data is outside HIPAA, so its use is governed by your contract with the covered entity and other law. Two cautions: check that your agreement lets you create de-identified data in the first place, and re-test the identification risk when you add new data sources.
Is the fact that someone is a patient PHI?
Yes, when a covered entity or its vendor holds it.
Being on a provider's patient list reveals that care was given, which is health information. A list of names from a speciality clinic can say a great deal without a single diagnosis on it.
Know where your PHI lives before anyone asks.
A HIPAA risk assessment starts with a data inventory that tags PHI field by field. Counsel should confirm how the definitions apply to your contracts.