Can you provide 10 examples of items that are considered protected health information (PHI)?

Protected Health Information (PHI) is any health, treatment, or payment data linked to a specific person.

Here are 10 common examples of items and identifiers that qualify as PHI when connected to health details:

• Names: A patient's full name or initials.
• Dates: Specific dates like a date of birth, admission, discharge, or appointment (except just the year).
• Geographic Data: Location details smaller than a state, such as a street address, city, county, or zip code.
• Contact Numbers: Phone numbers and fax numbers.
• Electronic Addresses: Email addresses, IP addresses, and website URLs.
• Government IDs: Social Security numbers (SSN) or Medicaid/Medicare numbers.
• Medical Record Numbers (MRN): Unique numbers assigned by a clinic or hospital to track a patient's file.
• Account and Insurance Numbers: Health plan beneficiary numbers, bank account data used for billing, or insurance policy numbers.
• Biometric Data: Unique physical measurements like fingerprints or retinal scans.
• Images and Photos: Full-face photographs or images showing unique identifying marks like scars or tattoos.

For more details on regulations, see the HHS Summary of the HIPAA Privacy Rule.

Protected Health Information (PHI) is any health, payment, or treatment data linked to an individual that can be used to identify them under HIPAA Rules.

10 Examples of PHI Items

Under the 18 HIPAA Identifiers, here are 10 common examples of items considered PHI when combined with health or payment details:

• Names: A patient’s full name or first/last name.
• Geographic data: Any location data more specific than a state, such as a street address, city, county, or ZIP code.
• Specific dates: Exact dates related to an individual (such as birth dates, admission dates, discharge dates, or appointment times).
• Telephone numbers: Home, work, or mobile numbers tied to a patient file.
• Email addresses: Personal or work email addresses used for medical correspondence.
• Social Security Numbers (SSN): A person’s government-issued Social Security number.
• Medical Record Numbers (MRN): Unique identification numbers assigned to a patient by a healthcare facility.
• Health plan beneficiary numbers: Insurance policy or member ID numbers.
• IP addresses: Internet Protocol addresses logged by patient portals or telehealth apps.
• Biometric identifiers: Unique physical measurements like fingerprints or voice prints.

Protected Health Information (PHI) is any data about health status, health care service, or payment for health care that can be linked to a specific person.

Under HIPAA Privacy Rule, health data becomes PHI when it is combined with any of 18 specific personal identifiers.

Common Examples of PHI

• Medical records: Doctor’s notes, lab test results, X-rays, prescriptions, and medical histories.
• Billing and payment data: Health insurance claims, hospital bills, and health plan beneficiary numbers.
• Communications: Emails or voicemails to a doctor’s office about appointments, symptoms, or prescriptions.

The 18 HIPAA Identifiers

When connected to health information, the 18 specific identifiers that turn ordinary records into protected PHI include names, geographic data smaller than a state, specific individual dates, contact details (phone, fax, email), and identification numbers such as SSNs, medical record numbers, and account numbers. Other identifiers cover vehicle and device serial numbers, URLs, IP addresses, biometric data, photos, and any unique characteristic linked to the individual. For the complete, detailed list of all 18 identifiers, please refer to the referenced web documents.

Note: Health data by itself is not PHI unless it is tied to one of these identifiers.

The most common HIPAA violations involve employee snooping, lost or stolen unencrypted devices, and failing to conduct organization-wide risk analyses.

The Health Insurance Portability and Accountability Act (HIPAA) protects patient health information. When healthcare groups or their business partners break these rules, it leads to heavy fines and legal trouble.

Top 10 Most Common HIPAA Violations

• Employee Snooping: Staff members look at patient files, such as records for coworkers or neighbors, without a valid work reason.
• Lost or Stolen Devices: Laptops, phones, or USB drives containing unencrypted electronic protected health information (ePHI) go missing in public.
• Lack of Organization-Wide Risk Analysis: Clinics fail to perform regular security audits to find weak spots in their computer and paper systems.
• Improper Disposal of Records: Staff throw away paper files with patient data in normal trash or fail to securely wipe old hard drives.
• Weak Access Controls: Offices use shared passwords, leave computer screens unlocked, or do not use multi-factor authentication.
• Unauthorized Texting or Emailing: Workers send patient data over regular, unsecured text messages or consumer email apps instead of encrypted platforms.
• Missing Business Associate Agreements (BAAs): Companies hire outside vendors—like billing firms or cloud software providers—without signing a legal BAA contract.
• Delayed Breach Notifications: Organizations take longer than the allowed 60 days to report a data breach to the government or affected patients.
• Inadequate Employee Training: Staff do not receive annual or proper education on how to handle private patient data safely.
• Denying Patient Record Access: Providers take more than 30 days to give patients copies of their own medical records.

To learn more, you can read the Most Common HIPAA Violations Guide.

The 18 elements of protected health information (PHI) under HIPAA are specific data points that, when combined with an individual's health information, make that data personally identifiable.

The 18 HIPAA Identifiers

• Names
• Geographic data smaller than a state (such as street, city, county, and full ZIP codes, with minor 3-digit ZIP code exceptions)
• Dates related to an individual (such as birth date, admission date, discharge date, and death date) except for the year, and exact ages over 89
• Telephone numbers
• Fax numbers
• Email addresses
• Social Security numbers (SSNs)
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate or license numbers
• Vehicle identifiers and serial numbers (including license plates)
• Device identifiers and serial numbers
• Web URLs
• IP addresses
• Biometric identifiers (including finger and voice prints)
• Full-face photographs and comparable images
• Any other unique identifying code, number, or characteristic

To learn more about how these rules apply, you can check the HIPAA Privacy Rule Overview provided by the U.S. Department of Health and Human Services.