What is PHI? Protected health information for practices and marketers

PHI in one paragraph

HIPAA's definitions sit in 45 CFR 160.103 (opens in a new tab). "Individually identifiable health information" is health information, "including demographic information collected from an individual," that is created or received by a provider, health plan, employer or clearinghouse; relates to a person's past, present or future physical or mental health, "the provision of health care to an individual," or payment for care; and either identifies the person or gives "a reasonable basis to believe" it could. Protected health information is that information when it is transmitted or maintained in any form or medium: electronic, paper or spoken.

The same definition excludes four categories: education records covered by FERPA (the federal student-records law), student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), "employment records held by a covered entity in its role as employer," and information about a person "who has been deceased for more than 50 years." When HHS finalized the Privacy Rule in 2000, it extended protection (opens in a new tab) to identifiable health information in any form, including paper that was never stored electronically.

Three tests: health information, identifiable, held by a covered entity

Run any piece of data through three questions. If all three answers are yes, treat it as PHI.

1. Does it relate to health, care or payment? A reason for visit relates to a condition. An appointment time relates to the provision of care. A consult deposit relates to payment. Even the bare fact that someone is your patient relates to care.
2. Does it identify the person, or could it reasonably? Names, phone numbers, emails, photos, record numbers and IP addresses all can. The de-identification rule's list of 18 identifiers is the practical checklist.
3. Does a covered entity or business associate hold it? An email address in a yoga studio's newsletter tool is not PHI. The same address in your booking system, tied to a consultation request, is.

Go deeper on the tests:

• The 18 HIPAA identifiers: every identifier on the list, mapped to where it hides in forms, URLs and analytics.
• Is a phone number PHI? Names, emails, birth dates and IP addresses, answered one by one.
• De-identified data: Safe Harbor vs Expert Determination, and when a marketing report stops being PHI.
• Limited data sets: the partly stripped data set for research and operations, and why it isn't a marketing loophole.

Examples of PHI on a practice website and in marketing

The review-reply row catches the most practices. The patient chose to post; your reply is your own disclosure. Using PHI for marketing, including testimonials, generally needs the patient's written authorization under 45 CFR 164.508(a)(3) (opens in a new tab), and our guide to HIPAA marketing rules covers the exceptions. To see whether your own site sends patient data where it shouldn't, a free marketing audit checks for privacy risks such as pixels on patient forms.

What isn't PHI

Not everything a practice holds is PHI, and knowing the edges saves staff from over-redacting useful reports.

• De-identified data. Under 45 CFR 164.514(a) (opens in a new tab), health information that doesn't identify anyone, and where there is "no reasonable basis to believe" it could, is not individually identifiable.
• Aggregate counts. "112 website form submissions this quarter" or "average age of new patients: 41" carry no identifiers.
• Your staff files. Employment records you hold as an employer are excluded, even a doctor's note in an employee's file.
• Health data at non-HIPAA companies. A fitness app's data isn't PHI unless the app works for a covered entity. The FTC notes (opens in a new tab) that its rules on unfair and deceptive practices apply to companies that collect health information outside HIPAA.
• Records of people deceased more than 50 years.

A patient's own public post is their speech, not your disclosure. The moment your team replies with details, the reply is yours.

Who HIPAA applies to

HIPAA applies to covered entities and their business associates. Under 160.103, covered entities are health plans, health care clearinghouses and "a health care provider who transmits any health information in electronic form in connection with a transaction" covered by the rules. CMS puts it plainly on its covered entity page (opens in a new tab): "Providers who submit HIPAA transactions, like claims, electronically are covered."

Business associates are vendors that create, receive, maintain or transmit PHI on your behalf: the billing company, the IT contractor, the host that stores form submissions, the CRM and the chat tool. They sign business associate agreements and are directly liable for their own compliance. Your website is often where those vendor relationships multiply, which is why HIPAA-compliant websites get their own guide.

• Who HIPAA applies to: the electronic-transaction test, cash-pay practices, med spas and the vendors HIPAA reaches.
• What HIPAA compliance means: an ongoing program, not a certificate, and how to read vendors' "HIPAA compliant" claims.

Practices in Canada answer to PIPEDA or provincial privacy laws instead. The federal privacy commissioner lists (opens in a new tab) Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador as having substantially similar health-information laws. Start with HIPAA in Canada.

The HIPAA rules in brief: Privacy, Security, Breach Notification

The Privacy Rule covers PHI in every form. The Security Rule covers only ePHI, but that now includes most of what a practice holds: EHR records, form submissions, email and backups. The breach rule sets the clock: patients must hear without unreasonable delay (opens in a new tab) "and in no case later than 60 calendar days after discovery," and a breach involving more than 500 residents of a state also requires notice to prominent media (opens in a new tab).

• The HIPAA Privacy Rule: permitted uses, patient rights, the Notice of Privacy Practices and the marketing limits.
• The HIPAA Security Rule: safeguards translated into MFA, encryption, access logs and backups for a small practice.
• Breach notification rule: a response runbook with deadlines and website scenarios.
• The minimum necessary rule: share only what each job, vendor and web form needs.

Penalties and enforcement

HHS's Office for Civil Rights (OCR) enforces the rules. Anyone can file a complaint, generally within 180 days (opens in a new tab) of learning of the problem, and OCR also runs compliance reviews and audits. Civil penalties come in four tiers based on culpability. Under the amounts in 45 CFR 102.3 (opens in a new tab), last adjusted for 2025, they run from $145 per violation where a practice "did not know" up to a calendar-year cap of $2,190,294. HHS announced on October 21, 2026 (opens in a new tab) that there will be no adjustment for 2026, so the 2025 figures still apply.

Two other routes exist. State attorneys general (opens in a new tab) may sue for damages of up to $100 per violation, capped at $25,000 per calendar year for identical violations. And knowingly obtaining or disclosing identifiable health information in violation of HIPAA is a federal crime (opens in a new tab), with fines up to $250,000 and 10 years in prison when the intent is to sell or use the information for gain or harm.

• HIPAA violation examples: front-desk, website, security and vendor slips, and why each counts.
• HIPAA fines and penalties: the tiers, the factors OCR weighs and what lowers your risk.

Where to start: a checklist for small practices

If HIPAA has never had an owner in your practice, these seven steps get you from zero to a defensible baseline:

1. Name a privacy official and a security official. One person can hold both roles (164.530(a) (opens in a new tab) and 164.308(a)(2) (opens in a new tab)).
2. Do a written risk analysis of every system holding ePHI, website and marketing tools included.
3. List every vendor that touches PHI and get a signed BAA from each.
4. Take tracking pixels off form, booking and condition pages, and keep ad platforms away from patient lists.
5. Post your Notice of Privacy Practices on your website. Section 164.520(c)(3)(i) (opens in a new tab) requires a covered entity with a website about its services to "prominently post" it there.
6. Train staff and document it. HIPAA documentation must be kept for six years.
7. Write a one-page breach plan: who decides, who calls counsel, where the 60-day clock starts.

• HIPAA compliance checklist: the full list sized for 1–20 staff, with the website items other checklists skip.
• HIPAA risk assessment: a step-by-step walkthrough using the free federal SRA Tool.

Medfy is built for this part of the job. Patient information from Medfy's forms, chat, inbox and CRM is stored in separate, encrypted HIPAA databases in the US or Canada. Medfy signs a Business Associate Agreement (BAA) with every practice before any patient data flows, and ad platforms never receive patient data. Read how Medfy handles patient data or see Medfy pricing.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

What are examples of PHI?

A patient's name with an appointment time, a contact form that includes a reason for visit, an insurance ID number, before-and-after photos showing a face, a newsletter list built from patient records, and a review reply confirming someone was treated. Each pairs an identifier with information about health, care or payment, held by a practice or its vendor. A count like '40 new patients this month' is not PHI.

Is a patient's name alone PHI?

It depends on who holds it and why. A name on a gym's mailing list isn't PHI. The same name in your scheduling system or patient list is, because it shows the person receives care from your practice, and HIPAA's definition covers information about the provision of health care to an individual. Treat every patient name your practice holds as PHI, and confirm edge cases with your compliance officer or attorney.

Is information on a website contact form PHI?

Usually, once your practice receives it. A form that collects a name, phone number and reason for visit creates identifiable information about care, so it belongs in a HIPAA-compliant form, stored encrypted, with vendors that sign a business associate agreement. An email-only newsletter signup on a general page is lower risk. This is general information, not legal advice: confirm your setup with your compliance officer or attorney.

Does HIPAA apply to cash-only practices?

Not automatically. A provider becomes a covered entity by sending health information electronically in a HIPAA standard transaction, such as a claim or an eligibility check, including through a billing service. A practice that never does may fall outside HIPAA, but state privacy laws and the FTC Act still apply, and many cash-pay practices follow HIPAA anyway. Confirm your status with your compliance officer or attorney.

What is the difference between PHI and ePHI?

ePHI is the part of PHI that is transmitted or maintained in electronic media: form submissions, EHR records, emails, spreadsheets and backups. The Privacy Rule protects PHI in every form, including paper and conversation. The Security Rule's administrative, physical and technical safeguards apply only to ePHI, which is why your website, inbox and cloud tools belong in your security risk analysis.

Who enforces HIPAA?

HHS's Office for Civil Rights (OCR) enforces the Privacy, Security and Breach Notification Rules through complaint investigations, compliance reviews and audits, and it can impose civil money penalties. State attorneys general can also sue on behalf of their residents. Criminal cases under the HIPAA statute go to federal prosecutors. If an OCR letter arrives, bring in your attorney early rather than answering alone.