Customer data glossary

Protected health information (PHI)

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Protected health information (PHI) is individually identifiable health information in electronic or any other form, subject to a few exclusions such as education and employment records.

Part of the Learn hub and the customer data glossary.

What it means in practice

The definition is in 45 CFR 160.103. Individually identifiable health information is information, including demographic information, that is created or received by a health care provider, health plan, employer or clearinghouse; relates to a person's past, present or future physical or mental health or condition, the provision of health care, or payment for care; and either identifies the person or gives a reasonable basis to believe it could identify them. PHI is that information when transmitted or maintained in electronic or any other form or medium 1.

The definition excludes education records covered by FERPA, certain related student records, employment records held by a covered entity in its role as employer, and information about a person who has been dead for more than 50 years 1. HIPAA's duties fall on covered entities and their business associates; the same information in an app that is neither is outside HIPAA, though other laws may apply.

In marketing systems the risk is combination. An email address is not health information. A list of a clinic's patient emails identifies people and relates to the provision of care, so it is likely PHI. A federal court (AHA v. Becerra, N.D. Tex., June 2024) vacated the part of HHS guidance that treated an IP address plus an unauthenticated public page visit as PHI, while the guidance on authenticated pages stands 2.

Example (hospital system): a patient-portal login event with an appointment type is PHI when the hospital holds it. The hospital sends it only to systems covered by a business associate agreement and keeps it out of advertising tools.

Business associate agreement: the vendor contract for PHI.
Data minimisation: limit PHI in marketing flows.
Consent state: authorisation and preferences.
Destination: where PHI must not leak.
Audit ledger: access records for PHI.

Where it matters

HIPAA marketing rules explained: authorisation, exceptions and pixels.
HIPAA-compliant customer data platforms: what "compliant" requires.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

Is an email address PHI?

Not by itself. It becomes PHI when linked to health, care or payment information held by a covered entity or business associate.

What is the difference between PHI and PII?

PII is a general privacy term. PHI is the HIPAA-defined category held in a covered role. PHI is often also PII, but not all PII is PHI.

Does PHI have to sit in a medical record?

No. The definition covers any form or medium, including marketing systems, when the data is identifiable health information held in a covered role.

Sources

45 CFR 160.103, definitions of "individually identifiable health information" and "protected health information" Open source
Quarles, HHS tracking-technology guidance vacated (secondary source) Open source

This entry is general information, not legal advice.