Is a patient’s name alone PHI?

Not by itself. PHI is health information that is individually identifiable, so it is the combination of a person’s identity with something about their health, care, or payment for care that makes it PHI. A name in a phone book is not PHI; the same name on an appointment schedule at a therapy practice is.

Is spoken information PHI?

Yes. PHI under 45 CFR 160.103 covers information in any form or medium, including oral. That is why the Security Rule expects reasonable safeguards for conversations at a front desk or in shared treatment areas, not just for electronic records.

What is the difference between PHI and ePHI?

ePHI is simply PHI that is transmitted or maintained in electronic media. The Security Rule (45 CFR 164.308 and following) applies specifically to ePHI, while the Privacy Rule applies to PHI in every form. Most small practices hold both, so their documentation has to address each.

Protected Health InformationPHI

Protected health information (PHI) is individually identifiable health information a covered entity or business associate holds or transmits in any form, electronic, paper, or oral. Under 45 CFR 160.103 it excludes education records governed by FERPA, employment records held by an employer, and information about someone deceased more than 50 years.

45 CFR § 160.103Read the regulation on eCFR

Last verified: July 23, 2026

What PHI means under HIPAA

PHI is the thing HIPAA exists to protect. The definition in 45 CFR 160.103 has two moving parts: the information must be individually identifiable health information (it relates to someone’s health, care, or payment for care, and could reasonably identify them), and it must be created, received, maintained, or transmitted by a covered entity or business associate. Electronic PHI is sometimes written ePHI, but the format does not change whether it is PHI: a paper chart, a voicemail, and a database row can all be PHI.

The exclusions matter as much as the definition. FERPA education records, records covered by 20 U.S.C. 1232g(a)(4)(B)(iv), employment records a covered entity holds as an employer, and information about a person dead more than 50 years are not PHI. That is why a school-based therapist’s records are often FERPA education records rather than HIPAA PHI, and why your own HR files are not PHI even though you are a covered entity.

Almost every other HIPAA obligation is downstream of this definition. Your Security Risk Analysis has to cover every system that touches PHI, your Notice of Privacy Practices describes how you use it, and your Business Associate Agreements exist because a vendor will handle it. If you can map where PHI lives in your practice, the rest of the binder follows.

See what a full HIPAA binder contains

Every document a private practice keeps to protect PHI, mapped to the rule that requires it.

PHI FAQ

Related terms

Covered Entity

45 CFR § 160.103

Minimum Necessary Standard

45 CFR § 164.502(b)

SRA

45 CFR § 164.308(a)(1)(ii)(A)

See every term in the HIPAA glossary.

Turn the vocabulary into the documents

Knowing the terms is step one. See the full document set a covered practice keeps, or generate the ones you can build yourself now.

See what goes in a HIPAA binder

Source

www.ecfr.gov/current/title-45/section-160.103

Last verified July 23, 2026. This definition is educational self-help information, not legal advice, and it paraphrases the regulation; the controlling text is 45 CFR § 160.103, linked above. Whether HIPAA applies to your practice depends on the covered-entity test. State law may add stronger requirements.