Protected health information (PHI) describes health data that is created, received, stored, or transmitted — by electronic media or in any other form or medium — by HIPAA-covered entities and their business associates in relation to the provision of healthcare, healthcare operations, and payment for healthcare services. Protected health information includes individually identifiable health information — i.e. health information that can be connected to a specific person, or information by which an individual could be identified. This could include medical histories, test results, insurance information, demographic data, and other information used to identify or provide healthcare or coverage for a patient.

Protected health information is protected under the HIPAA Privacy Rule, which sets standards to safeguard individuals’ PHI and establishes when PHI may be used and disclosed. The HIPAA Security Rule specifies technical, administrative, and physical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Compliance with HIPAA is required of those organizations and employees who work in or with the healthcare industry, or who have access to protected health information. Organizations working in healthcare or with related clients and prospects should have an understanding of what is considered protected health information under HIPAA law. Organizations that violate the provisions of the HIPAA Rules may be penalized.