What does PHI stand for? In healthcare it stands for protected health information: any health detail that can be tied to a specific person and is held by a doctor's office, hospital, health plan or one of their business partners. A diagnosis linked to your name, a lab result with your birth date, or a bill that shows both your address and your treatment all count.
The term comes from the privacy rules under HIPAA, the federal law that limits who can see and share that information. If you work at a clinic, a pharmacy or an insurer, you will hear PHI in nearly every training session.
Quick facts
Stands for
Protected health informationType
Initialism, said P H IComes from
HIPAA privacy rulesCovers
Health facts linked to a person who can be identifiedElectronic form
ePHIOther meaning
Phi, the Greek letter (said fie or fee)Not to be confused with
PII, personally identifiable information
What does PHI stand for in HIPAA?
Each word narrows down which data the rule protects:
- Protected: the information has legal safeguards on how it is used and shared.
- Health: it relates to a person's physical or mental health, the care they receive, or payment for that care, in the past, present or future.
- Information: it can be on paper, in a computer system or spoken aloud.
The rules apply to what the law calls covered entities, which are most health care providers, health plans and claims processors, plus the business associates that handle data for them. The full law is explained on the HIPAA page.
What counts as protected health information
Health data becomes PHI when it is connected to something that points to a real person. The rules list 18 kinds of identifiers. Some of the most common:
- Names, street addresses and, with narrow exceptions, ZIP codes
- Dates tied to the person, such as birth, admission or discharge dates
- Phone numbers, email addresses and fax numbers
- Social Security numbers and medical record numbers
- Health plan member numbers and account numbers
- Full face photos, fingerprints and voice prints
Remove all of these, following the rule's method, and the data is considered de-identified, which means it is no longer PHI.
In a clinic: a sticky note on a monitor reads "J. Rivera, room 4, allergy to penicillin." Because it pairs a name with a health detail, the PHI abbreviation applies, and staff are trained to keep notes like this out of public view.
PHI in daily healthcare work
The PHI acronym shapes small habits in every medical setting:
- Front desk staff lower their voices when confirming a patient's details.
- Records are locked or password protected.
- Staff only look at the charts they need for their job.
- Emails with patient data are sent through secure systems.
- Patients sign forms before their records are shared with someone new, except in cases the law allows, such as treatment and billing.
When data is stored or sent electronically, it is often called ePHI, electronic protected health information. The same protections apply, with extra security steps for computers and networks.
What is not PHI
Some health information falls outside the rule:
- Health notes kept by an employer in employment files, such as a doctor's note for sick leave.
- School health records, which follow the student privacy law described on the FERPA page.
- Data you enter yourself into many fitness or diet apps that are not working for a provider or health plan.
- Health data with every identifier removed.
Other laws may still protect some of these, but they are not PHI under HIPAA.
PHI vs PII and other look-alikes
| Term | Stands for | Scope |
|---|---|---|
| PHI | Protected health information | Identifiable health data held by covered health organizations |
| PII | Personally identifiable information | Details that can point to a specific person, whether or not health is involved |
| ePHI | Electronic protected health information | PHI stored or sent electronically |
All PHI includes personal identifiers, but plenty of personal data, like a shopping history, is not health related. See the PII page for that broader term.
Phi the letter, and how to say each
Outside healthcare, phi is the 21st letter of the Greek alphabet, written Φ or φ. In math it often names the golden ratio, about 1.618, and in physics and engineering it can label an angle or a magnetic flux. College groups use it in names such as Phi Beta Kappa, an honor society.
Pronunciation tells them apart. The health term is spelled out, "P H I." The Greek letter is said as a word, usually "fie" in the United States, and "fee" in some other places. Browse more everyday letters in our famous acronyms collection.
Questions people ask
What does PHI stand for in healthcare?
It stands for protected health information. It means health information that can identify a patient and is held by a provider, health plan or their business partners.
Is a patient's name alone PHI?
A name on its own is not health information. It becomes PHI when it is linked to health care, such as on an appointment list at a clinic, because that link reveals that the person received care.
What is the difference between PHI and PII?
PII is any information that can identify a person. PHI is a narrower group: identifiable health information covered by HIPAA. Most PHI contains PII, but most PII is not PHI.
How do you pronounce PHI?
In healthcare, say it letter by letter, P H I. The Greek letter phi is said like fie or fee.
Who has to protect PHI?
Health care providers, health plans, claims processors and the business associates who work for them must follow the HIPAA rules for PHI.