PHI is health information that identifies a person in the HIPAA context. PII is a broader term for information that can identify or be linked to someone. A name, date, or address can be PII on its own and part of PHI in a patient record.
Is PII the same as PHI?
No. NIST uses PII for information that can distinguish or trace a person's identity, or that is linked or linkable to a person. That is a federal-agency information-security definition, not one universal legal label.
HIPAA uses PHI for individually identifiable health information held or transmitted by a covered entity or its business associate. The health connection and the organization's role both matter.
How do PHI and PII compare?
| Question | PII | PHI under HIPAA |
|---|---|---|
| What makes it sensitive? | It identifies, distinguishes, or can be linked to a person. | It is identifiable health information in a covered health-care context. |
| Does the value alone decide? | No. The setting and nearby information can change what the value reveals. | No. A health record and the role of the organization are part of the definition. |
| What should you check? | Whether the value can point to one person alone or with other details. | Whether the record concerns a patient's health, care, or payment in the HIPAA context. |
Is a name PHI?
A name on a mailing list is personal information. The same name on an appointment list can reveal that the person is receiving care, so the surrounding record changes the question.
The format does not carry the answer by itself. Read the document beside the value, including the provider, visit, diagnosis, treatment, or payment detail around it.
Is a date PHI?
A date can be ordinary personal information in a calendar or a contract. A date of service, admission date, or date of birth in a patient record can carry health information when it is linked to the person.
Dates also become more revealing when they travel with other details. A birth date, postal code, and an unusual clinical detail can identify someone more readily together than any one detail alone.
Why do free text and combinations matter?
Identifying detail does not stay inside labelled fields. A narrative can connect a patient to a family member, employer, school, neighborhood, or rare event without using a dedicated identifier field.
Removing only the obvious names does not settle that context. HIPAA's Safe Harbor method requires the listed identifiers to be removed and no actual knowledge that the remaining information could identify the person.
What counts as PHI under HIPAA?
The Safe Harbor method names 18 identifier categories. They include names, contact details, many dates, record and account numbers, online identifiers, biometric details, images, and other unique identifying codes or characteristics.
Safe Harbor is one HIPAA de-identification method. HHS describes Expert Determination as the other method, so the list is not a universal PII checklist or a decision for every jurisdiction.
What should you do with the document in front of you?
First, ask what the document says about the person. Then ask which values and combinations make that person recognizable in this setting.
- Keep the record's health, care, payment, and organization context in view.
- Look beyond names to dates, locations, contact details, identifiers, and narrative clues.
- Name the governing law or policy before treating a label as a legal conclusion.
Where does PHI Mask fit?
PHI Mask surfaces detected values so you can judge the context around them. It helps make the name, date, address, and identifier questions visible while you prepare a document.
Start with text, a PDF, or a screenshot.
Review before sharing.
Sources and review notes
This guide was reviewed against HHS's HIPAA Privacy Rule summary, the HIPAA definitions in the eCFR, and NIST's PII guidance. The Safe Harbor description comes from the relevant regulation and HHS's de-identification guidance.
Common questions
- Is all health information PHI?
- No. HIPAA PHI describes identifiable health information held or transmitted by a covered entity or business associate. Health information without a link to a person does not meet that PHI description on its own.
- Is a name by itself PHI?
- No. A name becomes part of PHI when the surrounding HIPAA-covered health record links it to the person’s health, care, or payment.
- Does removing a name de-identify a record?
- No. Safe Harbor requires removal of its listed identifiers and no actual knowledge that the remaining information could identify the person. Expert Determination is a separate method.