PHI

Sources and review notes

These links support definition-level research and do not establish the regulatory status, safety, or suitability of any product.

HHS explains that the HIPAA Privacy Rule protects most individually identifiable health information held or transmitted by covered entities or business associates in electronic, paper, or oral form, while identifying information alone or health information outside the relevant HIPAA roles and context is not automatically PHI. HHS's de-identification guidance describes Expert Determination and Safe Harbor as the two Privacy Rule methods and notes that residual re-identification risk is not necessarily zero. The current federal text of 45 CFR Part 160 supplies the controlling definitions and scope. These sources do not classify every health-related data point or product workflow, certify a vendor as HIPAA compliant, or make a BAA, encryption claim, or de-identification label sufficient on its own. Organizations must map entity and business-associate roles, data provenance and context, identifiers and free text, permitted purposes and disclosures, minimum-necessary rules where applicable, individual rights, safeguards, retention, subprocessors, model-training use, de-identification or limited-data-set methods, re-identification risk, incidents, breach duties, and other applicable federal or state law with qualified privacy, security, legal, and compliance reviewers.

• Source 1: www.hhs.gov/hipaa/for-professionals/privacy/index.html
• Source 2: www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
• Source 3: www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160