Protected health information
By Gareth HoyleLast updated How we research
Protected health information is individually identifiable health information held or sent by a HIPAA covered entity or business associate, in any form.
Protected health information (PHI) is individually identifiable health information that is transmitted or maintained in any form or medium by a HIPAA covered entity or business associate, under 45 CFR 160.103. It covers health status, care and payment for care that can be linked to a person.
What is not protected health information?
The definition excludes education records covered by FERPA, employment records held by a covered entity in its role as employer and records about a person who has been dead for more than 50 years. Health data held by companies outside HIPAA, such as many wellness apps, is not PHI, though state laws such as Washington's consumer health data law may apply.
Can protected health information be licensed for AI training?
Protected health information cannot be sold without each individual's authorization under 45 CFR 164.502(a)(5)(ii). In practice, sellers license health data only after HIPAA Safe Harbor or Expert Determination de-identification, after which it is no longer PHI. See our medical practices page.
Under GDPR, data concerning health is special category data under Article 9.