I've worked for various healthcare companies and found there's a wide range of interpretation to what protected HIPAA data is. It should be more cut and dry, but in actual practice it seems to be a little confusing.

My questions:

  1. Can one of the 18 identifiers be PHI by itself, without having any medical information attached to it? For example an first and last name from an EHR system. I have always thought you need some sort of medical information attached with the 18 identifiers to make it PHI, otherwise without the health information, it's PII. So a first and last name with the diagnosis of diabetes is PHI, but my first and last name is not PHI, only PII.

  2. Does it matter where the information originated from? For example if a person inputs their health information into a healthcare website, say weight and medical condition, is that different from a doctor inputting that same data into their EHR?

  3. The definition states that it's protected if the covered entity receives the information - but what if the patient gives health information (let's say weight and medical conditions) to a downstream business associate (with a signed BAA)? I thought HITECH extended liability to downstream associates as if they were the covered entity.

It's worth posting the definition of protected health information for reference.

Under HIPAA, protected health information is considered to be individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, or transmitted, or maintained by a HIPAA-covered entity in relation to the provision of healthcare, payment for healthcare services, or use in healthcare operations (PHI healthcare business uses). Health information such as diagnoses, treatment information, medical test results, and prescription information are considered protected health information under HIPAA, as are national identification numbers and demographic information such as birth dates, gender, ethnicity, and contact and emergency contact information. PHI relates to physical records, while ePHI is any PHI that is created, stored, transmitted, or received electronically. PHI only relates to information on patients or health plan members. It does not include information contained in educational and employment records, that includes health information maintained by a HIPAA covered entity in its capacity as an employer. PHI is only considered PHI when an individual could be identified from the information. If all identifiers are stripped from health data, it ceases to be protected health information and the HIPAA Privacy Rule’s restrictions on uses and disclosures no longer apply.

  • Please explicitly state, and if possible link to, the source of the quote. Is this from the privacy rule, or some other official source? Commented Jul 5, 2022 at 18:07

1 Answer 1


Response to point 1:

  1. Yes, it’s true that for information to be classified as PHI, PII must be attached to the health information. If there is no health-related information that could be past, present or, future with the PII, it is only Personally Identifiable Information. E.g. if there is a web page with details like First Name, Last Name, Mobile No and health report attached, then the system is considered and PHI/ePHI. Secondly, all the health records have PII for traceability purposes.
  2. Secondly, First and Last Name also does not qualify to be PII, as it’s generic information. I can’t identify an individual basis First Name and Last Name; a 3rd attribute will be required.

Response to point 2:- 1. Not at all. 2. PHI is classified based on the kind of information irrespective of who is entering the data, whether its Data Subject, Covered Entity or Data Processor/Business Associate.

Response to Point 3:- 1. Even if the PHI is being collected by the Business Associate or downstream actors, it will still be classified as PHI. It is Covered Entities' responsibility to sign a Business Associate Agreement (BAA) with the Business Associate. The agreement should have the definition of the PHI for the understanding of all the affected parties.

  • 1
    "First and Last Name also does not qualify to be PII, as it’s generic information". I find that very hard to believe. Especially since the source of the information would be known. Commented Mar 17, 2020 at 18:33
  • I concur. Even though name is not a listed identifier like national numbers, etc, a name is still an identifier. A person's name and their health information could well be used to identify a specific person, particularly when associated with other lists. A name in a specific geographic area might be unique or nearly so. Best to treat a name as identifying information for HIPAA. Commented Jul 11, 2021 at 2:38
  • @pcalkins the source might be that third identifier. As for hoe distinctive a nhame is, that depends on the name. Many, perhaps most, names match many many individual people, I can't tell you how many other people naked "David Siegel" have come to my attention, but there have been lots. When I lived in a town of under 30k people, there were three others. n the Other hand "Mary Ann Monica Pedee" may be truly unique in the US.Mu understadning is the first+last name is treated as PII, because it may well be in a particular instance. Commented Nov 7, 2021 at 21:23
  • The name allows identification. There's probably many people with the same height, weight, blood-type, etc... but how many David Siegel's?... how many in a specific company or a specific health plan? If the aggregate data in a single record/set of data can be used to identify a single person it should be protected. There's wiggle room in their wording, but the intent is clear. Commented Nov 10, 2021 at 18:16

You must log in to answer this question.