Protected health information (PHI)

Two ingredients: health content and identifiability, in the hands of a regulated party. A diagnosis, prescription, lab result, appointment record, or an invoice for treatment becomes PHI when it can be tied to a person and it’s held by a covered entity or a business associate working for one. The same blood-pressure reading in a consumer wellness app sold directly to individuals generally isn’t PHI — context, not content, decides.

HIPAA’s de-identification safe harbor lists eighteen identifiers — names, address elements, dates tied to a person, phone and email, medical record and account numbers, device identifiers, IP addresses, photos, and a catch-all for any other unique identifying characteristic. In engineering terms the list is brutal: timestamps, user IDs, and IPs are everywhere in logs and analytics, so “we only store a little health data” rarely survives a real data-flow review. Strip or generalize all eighteen and data can fall out of PHI status; until then, treat it as in scope.

Every system PHI touches inherits HIPAA’s safeguard obligations and lands inside your BAA commitments. The practical work is mapping exactly where PHI enters, flows, and rests — then shrinking that footprint before securing what remains. That scoping exercise is where a HIPAA program starts.