What items are considered PHI under HIPAA?

Protected Health Information (PHI) under HIPAA is any individually identifiable health information related to a person's physical or mental health, healthcare services, or payment for care that is created, received, maintained, or transmitted by a Covered Entity or its business associate.

Core Requirements for PHI

For data to be considered PHI, two conditions must be met simultaneously:

• Health context: It relates to past, present, or future physical/mental health conditions, healthcare delivery, or payment for healthcare.
• Individual identity: It is linked to one of the 18 specific personal identifiers (or can reasonably identify the person).

The 18 HIPAA Identifiers

When health information is combined with any of the following identifiers, it becomes PHI:

• Names
• Geographic data smaller than a state (e.g., street address, city, county, zip code)
• Dates specific to an individual (birth date, admission date, discharge date, death date, or ages over 89)
• Telephone and fax numbers
• Email addresses and IP addresses
• Social Security numbers
• Medical record numbers and health plan beneficiary numbers
• Account numbers and certificate/license numbers
• Vehicle identifiers and serial numbers (license plates)
• Device identifiers and serial numbers
• Web URLs
• Biometric identifiers (fingerprints, voiceprints)
• Full-face photographs and comparable images
• Any other unique identifying number, characteristic, or code

Form and Scope

• Medium agnostic: PHI applies to information in any form or media, whether electronic (ePHI), paper records, or spoken verbally.
• Exclusions: Employment records held by a covered entity in its role as an employer and certain educational/student health records governed by FERPA are excluded.
• De-identified data: Data is no longer PHI if all 18 identifiers are completely removed.

Protected Health Information (PHI) is any health, payment, or treatment data linked to an individual that can be used to identify them under HIPAA Rules.

10 Examples of PHI Items

Under the 18 HIPAA Identifiers, here are 10 common examples of items considered PHI when combined with health or payment details:

• Names: A patient’s full name or first/last name.
• Geographic data: Any location data more specific than a state, such as a street address, city, county, or ZIP code.
• Specific dates: Exact dates related to an individual (such as birth dates, admission dates, discharge dates, or appointment times).
• Telephone numbers: Home, work, or mobile numbers tied to a patient file.
• Email addresses: Personal or work email addresses used for medical correspondence.
• Social Security Numbers (SSN): A person’s government-issued Social Security number.
• Medical Record Numbers (MRN): Unique identification numbers assigned to a patient by a healthcare facility.
• Health plan beneficiary numbers: Insurance policy or member ID numbers.
• IP addresses: Internet Protocol addresses logged by patient portals or telehealth apps.
• Biometric identifiers: Unique physical measurements like fingerprints or voice prints.

The 18 identifiers of Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA Overview) are specific data points that can be used to identify a patient, their relatives, employers, or household members.

To fully de-identify health data under HIPAA's Safe Harbor method, all 18 of these elements must be removed:

The 18 HIPAA Identifiers

• Names: Full names or parts of names.
• Geographic data: All geographic subdivisions smaller than a state, including street address, city, county, and precinct (with narrow exceptions for the initial three digits of a ZIP code).
• Dates: All specific date elements (such as birth date, admission date, discharge date, or date of death) directly linked to an individual, excluding the year.
• Ages over 89: All ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older.
• Telephone numbers: Direct phone contact numbers.
• Fax numbers: Facsimile numbers.
• Email addresses: Electronic mail contact details.
• Social Security numbers (SSN): Individual SSNs.
• Medical record numbers: Patient file or chart identification numbers.
• Health plan beneficiary numbers: Insurance policy or member ID numbers.
• Account numbers: Financial or billing account numbers.
• Certificate or license numbers: Professional or driving license/certificate numbers.
• Vehicle identifiers: Vehicle serial numbers or license plate numbers.
• Device identifiers: Medical device serial numbers or tracking codes.
• Web URLs: Uniform Resource Locators pointing to specific web pages.
• IP addresses: Internet Protocol addresses used for digital networking.
• Biometric identifiers: Measurable physical characteristics, including finger, retinal, or voice prints.
• Full-face photographs: Facial photos and any comparable images.
• Unique identifying codes: Any other unique identifying number, characteristic, or code meant to single out the person.

You can review further details on these rules through guidelines from Loyola University Chicago or UC Berkeley.

Because you didn't include the specific multiple-choice options or items to choose from, I can't point directly to the correct option. However, I can give you the exact criteria to easily figure out the right answer.

Under HIPAA, Protected Health Information (PHI) is defined as any health, treatment, or payment data that can be linked to a specific individual. To be considered PHI, an item must contain both health/medical data and at least one personal identifier.

To evaluate your items, check them against the 18 specific HIPAA identifiers (such as names, geographic data smaller than a state, specific dates, contact numbers, SSNs, and biometric data); the full list of these identifiers can be found in the reference documents.

Quick Checklist for Your Options:

• 👥 Is it PHI? Any medical diagnosis, treatment record, lab test result, or billing statement that is tied to one of the personal identifiers above.
• ❌ Is it NOT PHI?
  • Health data completely stripped of all 18 identifiers (de-identified data).
  • Common identifiers sitting alone without any medical context.
  • Employment records held by a covered entity acting as an employer.
  • Student health records covered under FERPA.

If you reply with the specific options from your question, I would be happy to identify the exact correct answer for you!

Because you didn't include the specific list of multiple-choice options in your question, the exact answer choice cannot be explicitly matched. However, based on standard medical compliance and HIPAA testing questions, the correct answer is typically an Informational pamphlet (or alternatively, personal items belonging to patients / benefits information without identifying details).

Here is an explanation of why certain items do or do not contain Protected Health Information (PHI):

❌ Items that do NOT contain PHI

• Informational pamphlet: These documents provide general health, wellness, or educational information intended for a broad audience. They contain no individual patient names, medical histories, or tracking data, meaning they do not violate HIPAA privacy rules.
• Personal items: Belongings like clothing, grooming items, or jewelry do not hold medical data or health tracking information.
• De-identified health information: Health or benefits data that has had all 18 HIPAA identifiers (such as names, specific dates, and biometric identifiers) completely removed is no longer considered PHI.

⭕ Items that DO contain PHI

The following items are regulated under HIPAA because they contain explicitly identifiable data tied to a person's healthcare, diagnosis, or financial payment records:

• Medical claim forms (contains patient identifiers, diagnosis codes, and billing information)
• Explanation of Benefits (EOB) (contains insurance numbers, patient names, and breakdown of services rendered)
• Electronic prescriptions / EHRs (contains patient names, specific dosages, and provider details)
• Patient ID bracelets and IV labels (contains medical record numbers and names)

If your question has a different set of choices, please reply with the options and I will gladly identify the correct one for you!