I've worked for various healthcare companies and found there's a wide range of interpretation to what protected HIPAA data is. It should be more cut and dry, but in actual practice it seems to be a little confusing.

My questions:

  1. Can one of the 18 identifiers be PHI by itself, without having any medical information attached to it? For example an first and last name from an EHR system. I have always thought you need some sort of medical information attached with the 18 identifiers to make it PHI, otherwise without the health information, it's PII. So a first and last name with the diagnosis of diabetes is PHI, but my first and last name is not PHI, only PII.

  2. Does it matter where the information originated from? For example if a person inputs their health information into a healthcare website, say weight and medical condition, is that different from a doctor inputting that same data into their EHR?

  3. The definition states that it's protected if the covered entity receives the information - but what if the patient gives health information (let's say weight and medical conditions) to a downstream business associate (with a signed BAA)? I thought HITECH extended liability to downstream associates as if they were the covered entity.

It's worth posting the definition of protected health information for reference.

Under HIPAA, protected health information is considered to be individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, or transmitted, or maintained by a HIPAA-covered entity in relation to the provision of healthcare, payment for healthcare services, or use in healthcare operations (PHI healthcare business uses). Health information such as diagnoses, treatment information, medical test results, and prescription information are considered protected health information under HIPAA, as are national identification numbers and demographic information such as birth dates, gender, ethnicity, and contact and emergency contact information. PHI relates to physical records, while ePHI is any PHI that is created, stored, transmitted, or received electronically. PHI only relates to information on patients or health plan members. It does not include information contained in educational and employment records, that includes health information maintained by a HIPAA covered entity in its capacity as an employer. PHI is only considered PHI when an individual could be identified from the information. If all identifiers are stripped from health data, it ceases to be protected health information and the HIPAA Privacy Rule’s restrictions on uses and disclosures no longer apply.


Response to point 1:

  1. Yes, it’s true that for information to be classified as PHI, PII must be attached to the health information. If there is no health-related information that could be past, present or, future with the PII, it is only Personally Identifiable Information. E.g. if there is a web page with details like First Name, Last Name, Mobile No and health report attached, then the system is considered and PHI/ePHI. Secondly, all the health records have PII for traceability purposes.
  2. Secondly, First and Last Name also does not qualify to be PII, as it’s generic information. I can’t identify an individual basis First Name and Last Name; a 3rd attribute will be required.

Response to point 2:- 1. Not at all. 2. PHI is classified based on the kind of information irrespective of who is entering the data, whether its Data Subject, Covered Entity or Data Processor/Business Associate.

Response to Point 3:- 1. Even if the PHI is being collected by the Business Associate or downstream actors, it will still be classified as PHI. It is Covered Entities' responsibility to sign a Business Associate Agreement (BAA) with the Business Associate. The agreement should have the definition of the PHI for the understanding of all the affected parties.

  • "First and Last Name also does not qualify to be PII, as it’s generic information". I find that very hard to believe. Especially since the source of the information would be known. – pcalkins Mar 17 '20 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy