Protected health information (PHI)

Protected health information (PHI)

Protected health information (PHI)

On this page

PHI & The 18 Identifiers - Secrets to Keep

  • Protected Health Information (PHI) is any health data that is individually identifiable. It is created or received by a healthcare provider, health plan, or clearinghouse and relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the payment for that care.

  • Below are the 18 identifiers that make health information PHI. Data is considered de-identified (and not subject to the Privacy Rule) only if all these identifiers are removed.

CategoryIdentifiers
PersonalNames, All geographic subdivisions smaller than a state, All elements of dates (except year)
ContactTelephone numbers, Fax numbers, Electronic mail addresses
NumericSocial Security numbers, Medical record numbers, Health plan beneficiary numbers
AccountAccount numbers, Certificate/license numbers, Vehicle identifiers and serial numbers
DeviceDevice identifiers and serial numbers, Web Universal Resource Locators (URLs)
BiometricBiometric identifiers (finger and voice prints), Full face photographic images
OtherAny other unique identifying number, characteristic, or code

The Privacy Rule - Who Can Know?

Governs the use and disclosure of Protected Health Information (PHI). The core principle is the 'Minimum Necessary' standard: disclose only the minimum PHI required to achieve the purpose.

  • Permitted Uses & Disclosures for TPO:

    • Treatment: Sharing info with other providers for patient care.
    • Payment: Submitting claims to insurance companies.
    • Operations: Activities like quality assessment, training, and business planning.
  • Disclosure WITHOUT Patient Authorization is allowed in specific public interest scenarios:

    • Public health activities (e.g., reporting infectious diseases).
    • Reporting suspected abuse, neglect, or domestic violence.
    • Law enforcement requests (e.g., court orders, warrants).
    • Coroner or medical examiner for identifying a deceased person.
    • Organ donation processes.

Exam Favorite: If a patient is present and has capacity, a provider can share PHI with family/friends if the patient agrees or does not object. Professional judgment is key.

Patient Rights & Violations - The Power & The Price

  • Patient Rights (The Power): Patients have the right to:

    • Access & Copy: Obtain a copy of their PHI.
    • Amend: Request corrections to their PHI.
    • Accounting of Disclosures: Know who their PHI has been shared with.
  • HIPAA Security Rule (The Protection): Mandates safeguards for electronic PHI (ePHI).

    • Administrative: Policies, risk analysis, training.
    • Physical: Facility access controls, workstation security.
    • Technical: Access control, audit controls, transmission security.

The 3 Types of HIPAA Safeguards

  • Violations & Penalties (The Price): Civil and criminal penalties are tiered based on the level of culpability, from unintentional ignorance to willful neglect.

Exam Favorite: The "Minimum Necessary" rule is a cornerstone of HIPAA. Disclosures of PHI should be limited to the minimum amount of information necessary to accomplish the intended purpose.

High-Yield Points - ⚡ Biggest Takeaways

  • PHI is any individually identifiable health information (demographics, treatment, payment).
  • It's defined by the presence of one or more of the 18 specific identifiers (e.g., name, address, dates).
  • De-identified data (all identifiers removed) is not protected by HIPAA.
  • The Minimum Necessary Rule limits PHI disclosure to the least amount required for the task.
  • Patients can access, amend, and request an accounting of their PHI disclosures.
  • Incidental disclosures are not violations if reasonable safeguards are implemented.

Practice Questions: Protected health information (PHI)

Test your understanding with these related questions

A 68-year-old man comes to the physician for a follow-up examination, accompanied by his daughter. Two years ago, he was diagnosed with localized prostate cancer, for which he underwent radiation therapy. He moved to the area 1 month ago to be closer to his daughter but continues to live independently. He was recently diagnosed with osteoblastic metastases to the spine and is scheduled to initiate therapy next week. In private, the patient’s daughter says that he has been losing weight and wetting the bed, and she tearfully asks the physician if his prostate cancer has returned. She says that her father has not spoken with her about his health recently. The patient has previously expressed to the physician that he does not want his family members to know about his condition because they “would worry too much.” Which of the following initial statements by the physician is most appropriate?

1 of 5

Flashcards: Protected health information (PHI)

1/10

A _____ is a medical outcome that should never occur

TAP TO REVEAL ANSWER

A _____ is a medical outcome that should never occur

"never event"

browseSpaceflip

Enjoying this lesson?

Get full access to all lessons, practice questions, and more.

Start Your Free Trial