[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Protected Health Information (PHI)?](/blog/protected-health-information-phi) Publish date July 4, 2025 {x} minute read # What is Protected Health Information (PHI)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/hipaa-compliance-without-the-headache) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook HIPAA Compliance Without the Headache Free resource ### HIPAA Compliance Without the Headache [Download now](/resources/hipaa-compliance-without-the-headache) Protected health information (PHI) is any information about health status, provision of health care or payment for health care that is created or collected by a covered entity, or their business associate, and can be linked to a specific individual.  The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires covered entities to implement safeguards to ensure the [confidentiality, integrity and availability](/blog/cia-triad) of PHI. The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 also limited the types of PHI that can be collected from individuals, shared with other organizations or used in marketing. ### What is a Covered Entity? According to the U.S. Department of Health & Human Services (HHS) a covered entity is any healthcare provider, health plan or healthcare clearinghouse: * Healthcare providers: hospitals, doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies * Health plans: health insurance companies, health maintenance organization, company health plans, Medicare and Medicaid * Healthcare clearinghouses: takes in information from a healthcare entity, standardizes the data and then provides the information to another healthcare entity A business associate is a [third-party vendor](https://www.upguard.com/blog/third-party-vendor) who performs services on behalf of a HIPAA-covered entity that requires access to, or the use of, protected health information (PHI). It's important to note HIPAA regulation treats data storage companies like AWS, GCP and Azure as business associates. [Learn how to comply with HIPAA's third-party risk requirements.](https://www.upguard.com/blog/third-party-risk-requirements-hipaa) ## What is the Definition of Protected Health Information (PHI)? Protected health information (PHI) is the past, present and future of physical and mental health data and the condition of an individual created, received, stored or transmitted by HIPAA-covered entities and their business associates. PHI can relate to provision of healthcare, healthcare operations and past, present or future payment for healthcare services. PHI is a form of [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) that is protected under the [HIPAA Privacy Rule](/blog/hipaa-privacy-rule).  PHI includes all identifiable health information, including demographic information, medical history, test results, insurance information and other information that could be used to identify a patient or provide healthcare services or coverage.  The method of storage and transmission, whether electronic media or otherwise, does not affect PHI classification.   ## What are Some Examples of Protected Health Information (PHI)? HIPAA outlines 18 identifiers that must be treated with special care: 1. Names 2. All geographical identifiers smaller than a state, except for the initial three digits of a zip code if, according to the current publicly available data from the U.S. Bureau of the Census: the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000 3. Dates (other than year) directly related to an individual 4. Phone Numbers 5. Fax numbers 6. Email addresses 7. Social Security numbers 8. Medical record numbers 9. Health plan beneficiary number 10. Account numbers 11. Certificate/license numbers 12. Vehicle identifiers and serial numbers, including license plate numbers; 13. Device identifiers and serial numbers; 14. Web Uniform Resource Locators (URLs) 15. Internet Protocol (IP) address numbers 16. [Biometric identifiers](https://www.upguard.com/blog/biometrics), including finger, retinal and voice prints 17. Full face photographic images and any comparable images 18. Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data PHI is any [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) that can be linked to health records or is used by a HIPAA covered entity or business associate in relation to healthcare services or payment. Practically speaking PHI can show up in a number of different documents, forms and communication including: * Billing information * Emails * Appointment scheduling apps * MRI scans * Blood test results * Phone records ## What is ePHI? Electronic protected health information (ePHI) is any PHI created, stored, transmitted or received electronically. The HIPAA Security Rule has guidelines in place that dictate how to assess ePHI. ePHI includes any PHI data stored on: * Personal computers used at home, work or travel * External hard drives * Magnetic tape * Removable storage such as USB drives, CDs, DVDs and SD cards * Smartphones and other smart devices * Email * File transfer and cloud storage solutions ## What is Not Considered Protected Health Information (PHI)? Any data that does not meet the following two conditions is not PHI: * Data can identify the patient * Data is used or disclosed by a covered entity during the course of care Note: education records or employment records are covered by different federal regulations and do not apply to a cover entity in its role as an employer. In the case of an employee-patient, protected health information does not include information held on the employee by the healthcare organization in its role as an employer, only as a healthcare provider. Further, information about a person who has been deceased for more than 50 years is no longer considered PHI. ## What is PHI Used For? Healthcare organizations deal with [sensitive data](https://www.upguard.com/blog/sensitive-data) about patients, including birth dates, medical conditions and insurance claims.  Beyond its use to patients and health professionals, PHI is valuable to clinical and scientific researchers when de-identified or anonymized. For cyber criminals, PHI is valuable [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) that can be used for identity theft, sold on the [dark web](https://www.upguard.com/blog/dark-web) or held hostage through [ransomware](https://www.upguard.com/blog/ransomware). This is why organizations cannot sell PHI unless it's used for public health activities, research, treatment, services rendered or the merger or acquisition of a HIPAA-covered entity and has been de-identified or anonymized.  HIPAA also gives individuals the right to make written requests to amend PHI stored in a covered entity.  ### What is De-Identification and Anonymization? De-identification under the HIPAA Privacy Rule is when data is stripped of common identifiers by removing the specific identifiers listed above and then verifying with an experienced statistician who can validate and document that the statistical risk of re-identification is very small.   Anonymization is the process in which PHI elements are eliminated or manipulated with the purpose of hindering the possibility of going back to the original data set. This means removing all identifying data to create unlinkable data.  De-identification and anonymization allows healthcare data to be used for research, development and marketing purposes.  ## What are the Data Protection Requirements of Protected Health Information (PHI)? Covered entities and business associates sign HIPAA business associate agreements that legally bounds them to handle PHI in a way that satisfies the HIPAA Privacy and Security Rules.  They are also subject to HIPAA audits conducted by the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) to prove they are HIPAA compliant.  Data protection requirements are outlined in HIPAA Privacy and Security Rules. HIPAA Privacy governs how healthcare organizations can use and share PHI. Meanwhile, the Security Rules cover security measures, including software, that restrict unauthorized access to PHI. Covered entities must demonstrate their [cybersecurity](https://www.upguard.com/blog/cyber-security) minimizes the likelihood of unintended disclosure of PHI in [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak). [Vendor risk management](https://www.upguard.com/blog/vendor-risk-management) is a particularly important part of managing [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) for covered entities who outsource to [third-party vendors](https://www.upguard.com/blog/third-party-vendor).   Before entering into any business associate agreements, covered entities must perform a [cybersecurity risk assessment](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) to understand how the business associate manages [information security](https://www.upguard.com/blog/information-security) and whether they meet HIPAA compliance.  Ask to see their [information security policy](https://www.upguard.com/blog/information-security-policy) and [SOC 2 report](https://www.upguard.com/blog/soc-2). Cover entities must have a robust [third-party risk management framework](https://www.upguard.com/blog/third-party-risk-management-framework) and [vendor management policy](https://www.upguard.com/blog/vendor-management-policy), and where possible [automate vendor risk management](https://www.upguard.com/blog/automate-vendor-risk-management).  ## Should Healthcare Organizations Invest in Cybersecurity? With increased scrutiny for HIPAA violations, massive fines for PHI [data breaches](https://www.upguard.com/blog/data-breach) and no safe harbor for accidental PHI [data leaks](https://www.upguard.com/blog/data-leak), it pays to invest in cybersecurity. Depending on the level of negligence, fines range from $100 to $50,000 for a single accidental violation, with a single violation due to willful neglect resulting in an automatic $50,000 fine. The maximum penalty for violations of an identical provision is $1.5 million per year. Pair this with new data privacy laws in the European Union, e.g. The [General Data Protection Regulation (GDPR)](https://www.upguard.com/blog/how-to-be-gdpr-compliant) which impacts [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) more widely. The truth is that every third-party vendor introduces third-party risk and [fourth-party risk](https://www.upguard.com/blog/what-is-fourth-party-risk), increasing possible [attack vectors](https://www.upguard.com/blog/attack-vector) ([vulnerabilities](https://www.upguard.com/blog/vulnerability), [malware](https://www.upguard.com/blog/malware), [phishing](https://www.upguard.com/blog/phishing), [email spoofing](https://www.upguard.com/blog/email-spoofing), [domain hijacking](https://www.upguard.com/blog/domain-hijacking) and [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack)) a cyber criminal could use to launch a successful [cyber attack](https://www.upguard.com/blog/cyber-attack). This is why [defense in depth](https://www.upguard.com/blog/defense-in-depth) is important. Due to the reproducibility of data and limitations of [digital forensics](https://www.upguard.com/blog/digital-forensics) and [IP attribution](https://www.upguard.com/blog/ip-attribution), it's almost impossible to track down where exposed data ends up. In monetary terms, the [average cost of a healthcare data breach](https://www.upguard.com/blog/cost-of-data-breach) is $6.45 million. It pays to [prevent data breaches](https://www.upguard.com/blog/prevent-data-breaches). [*Find out how healthcare organizations can prevent data breaches.*](https://www.upguard.com/blog/healthcare-prevent-data-breaches) ## How UpGuard Can Prevent Protected Health Information (PHI) Data Breaches and Data Leaks UpGuard monitors both the internal and external attack surface for data leaks and security exposures putting PHI at risk of compromise. UpGuard helps you manage the complete Vendor Risk Management lifecycle, from securing the vendor onboarding process to executive reports summarising your VRM efforts. With UpGuard, you can have greater peace of mind over the security and integrity of all customer PHI data. eBook HIPAA Compliance Without the Headache Free resource ### HIPAA Compliance Without the Headache [Download now](/resources/hipaa-compliance-without-the-headache) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)