Protected health information (PHI)
Health information that identifies you and is held by a doctor, hospital, insurer or their vendors. HIPAA protects it, and a breach of it can lead to a class action.
Also called: PHI, ePHI, individually identifiable health information
Health information that identifies you and is held by a doctor, hospital, insurer or their vendors. HIPAA protects it, and a breach of it can lead to a class action.
What it means
Protected health information (PHI) is health information that identifies you and is held by a health care provider, a health plan, a billing clearinghouse, or a business that works for one of them. Under the federal HIPAA rules, it covers your health, the care you got, and payment for that care. It counts whether it is on paper, electronic or spoken.
What makes information PHI is who holds it. Your chart, insurance claims, appointment dates and billing records at a hospital are PHI. The same kind of data in a fitness tracker or period-tracking app is usually not PHI, because those apps are generally not covered by HIPAA. Employment records a covered organization keeps as an employer are also excluded.
Data stops being PHI when identifiers are removed. One method strips 18 types of identifiers, such as names, full dates, phone numbers, email addresses and Social Security numbers. Another uses an expert who finds the risk of identifying anyone to be very small.
What it means for you
When a hospital, insurer or vendor is breached, the stolen data is usually PHI. HIPAA then requires written notice to you. It must arrive no later than 60 days after the organization discovers the breach. That letter can be your first sign that a class action exists. Health data settlements may add medical-information monitoring to credit monitoring. If a health app or website shared your data with advertisers, it may not be PHI. You can still have a claim under privacy or consumer protection laws. Read the class definition in your notice.
Example
Say a hypothetical hospital emails you that a laptop holding patient files was stolen. The files held names, birth dates, diagnosis codes and insurance ID numbers. That is PHI, so the hospital must send you a written notice and may offer credit monitoring. Now say a hypothetical sleep-tracking app leaks your nightly heart-rate data. The data is health related, but the app is not a doctor or insurer, so it is probably not PHI. HIPAA probably does not apply, though other laws, such as the FTC's health breach rule, might.
FAQ
Usually not. PHI depends on who holds the data. HIPAA covers health plans, most health care providers, clearinghouses and their business associates, so a consumer app that is none of those is generally outside it. The FTC can still act, including under its Health Breach Notification Rule.
They include names, locations smaller than a state, all dates except the year, phone and fax numbers, email addresses, Social Security numbers, medical record, plan and account numbers, certificate and license numbers, vehicle and device identifiers, web addresses, IP addresses, biometric identifiers, full-face photos, and any other unique code. Removing all 18 is one way to de-identify data.
Related terms
- 45 CFR 160.103: definitions of protected health information, covered entity and business associate (Cornell LII)
- 45 CFR 164.514: de-identification and the 18 identifiers (Cornell LII)
- 45 CFR 164.404: breach notice to individuals (Cornell LII)
- FTC: Collecting, using or sharing consumer health information
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.