What Counts as PHI Under HIPAA?

Protected Health Information (PHI) is at the heart of HIPAA compliance.

PHI includes any individually identifiable health information that relates to:

• The individual’s past, present, or future physical or mental health

• The provision of healthcare to the individual

• Payment for the provision of healthcare

PHI may appear in any form—electronic, paper, or oral—and includes data such as:

• Names

• Addresses

• Social Security numbers

• Medical record numbers

• Health plan beneficiary numbers

• Full-face photographs

• Any other identifying details related to health or healthcare services

Understanding what qualifies as PHI is essential for properly defining HIPAA compliance scope and implementing appropriate safeguards.

This clarity also supports consistent data protection across other frameworks like GDPR and ISO 27001.