What is PHI or Protected Health information?

A covered entity is any health plan, health care clearing house, or health care provider who transmits any health information in electronic form in connection with a qualified transaction and their business associates. Indiana University has designated itself as a Hybrid Covered Entity and all IU HIPAA Affected Areas are expected to adhere to the HIPAA Privacy and Security Rules as well as any other area or unit that creates, uses, or stores PHI from another HIPAA Affected Area or outside covered entity.

Data are “individually identifiable” if they include any of the 18 types of identifiers for an individual or for the individual’s employer or family member, or if the provider or researcher is aware that the information could be used, either alone or in combination with other information, to identify an individual. These identifiers are:

• Name
• Address (all geographic subdivisions smaller than state, including street address, city, county, or ZIP code)
• All elements (except years) of dates related to an individual (including birth date, admission date, discharge date, date of death, and exact age if over 89)
• Telephone numbers
• FAX number
• Email address
• Social Security number
• Medical record number
• Health plan beneficiary number
• Account number
• Certificate/license number
• Vehicle identifiers and serial numbers, including license plate numbers
• Device identifiers or serial numbers
• Web URLs
• IP address
• Biometric identifiers, including finger or voice prints
• Full-face photographic images and any comparable images
• Any other unique identifying number, characteristic, or code

All protected health information is subject to federal Health Insurance Portability and Accountability Act (HIPAA) regulation. 

What is EPHI or Electronic Protected Health Information?