Healthcare Data GlossaryRegulatory
PHI: Definition and Healthcare Context
Full name: Protected Health Information
Protected Health Information (PHI) is any individually identifiable health information held or transmitted by a HIPAA covered entity or business associate, in any form or medium. PHI includes diagnoses, treatment records, payment information, and any data that could identify the individual — name, address, dates of service, Social Security number, and 16 other identifiers enumerated in the HIPAA Privacy Rule. De-identified information that cannot reasonably be used to identify an individual is not PHI and falls outside HIPAA's Privacy Rule protections.
Last updated: 2026-06-17Reviewed by: Dr. Jennifer Montecillo, MD — Gullas College of Medicine, 2019. Non-practicing medical reviewer.
How it’s used
- CMS NPPES NPI Registry: NPPES bulk data is not PHI — provider names and business addresses are not patient information. Fonteum uses it to build provider profiles without handling patient data.
- HIPAA Privacy Rule (45 CFR Parts 160 and 164): the Privacy Rule enumerates the 18 identifiers that turn health information into PHI and governs how covered entities may use or disclose it — the boundary Fonteum stays outside of by sourcing only public provider-level records.
- CMS public-use files: every dataset Fonteum ingests — NPPES, PECOS, Open Payments, Care Compare — is a provider-level or de-identified public file, so no PHI enters the provenance graph.
Frequently asked questions
- What is PHI?
- PHI (Protected Health Information) is individually identifiable health information — any data that could identify a patient combined with their health, treatment, or payment information.
- What are examples of PHI?
- PHI includes patient names, dates of service, geographic data below the state level, phone numbers, email addresses, Social Security numbers, medical record numbers, and diagnosis or treatment information.
- Is de-identified data still PHI?
- No. Data that has been de-identified using the HIPAA Safe Harbor or Expert Determination method is not considered PHI and falls outside the Privacy Rule.