HIPAA protects protected health information, usually called PHI. Knowing what counts as PHI is the first step in protecting it.
What PHI is
PHI is individually identifiable health information held or transmitted by a covered entity or business associate, in any form — spoken, on paper or electronic. It is information that:
- relates to a person's past, present or future physical or mental health or condition, the health care provided to them, or the payment for that care; and
- identifies the person, or could reasonably be used to identify them.
Examples of PHI:
- a chart note, lab result, x-ray or prescription;
- an appointment schedule showing who is coming in today;
- a bill or insurance claim;
- a conversation about a patient's diagnosis;
- a photo of a patient, or a wristband with their name and date of birth.
Even the fact that someone is a patient of a particular clinic can be PHI.
What is not PHI: employment records an organization keeps as an employer (for example, your own sick-leave file in HR), and education records covered by FERPA. Health information that has been properly de-identified is also not PHI.
ePHI
ePHI is PHI that is created, received, kept or sent in electronic form — the electronic health record, emails, texts, files on a laptop or USB drive, scanned documents, data in a billing system. The Security Rule applies to ePHI. The Privacy Rule applies to PHI in all forms, including paper and spoken words.
The 18 identifiers
The Privacy Rule's Safe Harbor method of de-identification lists 18 identifiers that must be removed — for the person and for their relatives, employers or household members:
- Names
- Geographic subdivisions smaller than a state — street address, city, county, ZIP code (the first three digits of a ZIP code may be kept in some cases)
- All elements of dates (except the year) directly related to the person — birth date, admission date, discharge date, date of death — and all ages over 89
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers, including license plates
- Device identifiers and serial numbers
- Web addresses (URLs)
- IP addresses
- Biometric identifiers, such as fingerprints and voiceprints
- Full-face photos and comparable images
- Any other unique identifying number, characteristic or code
De-identification basics
Information is de-identified when it no longer identifies a person and there is no reasonable basis to believe it could. HIPAA allows two methods:
- Safe Harbor — remove all 18 identifiers, and the organization has no actual knowledge that what is left could identify the person.
- Expert Determination — a qualified expert applies statistical or scientific methods and documents that the risk of re-identification is very small.
De-identified information is not PHI, so the Privacy Rule no longer restricts it. In everyday work, though, removing only the name is not de-identification. A post that says "the 34-year-old teacher from Maple Street we admitted Tuesday with a gunshot wound" can easily identify someone.
Scenarios
A whiteboard. A unit whiteboard lists room numbers, patients' last names and their fall-risk status. This is PHI visible to anyone walking past. Organizations reduce the risk by placing boards out of public view or using limited information such as initials — follow your unit's policy.
A spreadsheet for a quality project. A manager asks for a spreadsheet of infection rates. If it will be shared outside the team, removing names alone is not enough: dates of admission, ZIP codes and record numbers are identifiers too. Ask your privacy officer whether the data can be properly de-identified, or whether another permitted route applies.
A photo on a phone. A wound photo taken for the chart on a personal phone is ePHI on a personal device, even if the face is not shown. Use only the devices and apps your organization provides for clinical photos.
Key points
- PHI is identifiable health, care or payment information in any form: spoken, paper or electronic.
- ePHI is PHI in electronic form; the Security Rule protects it.
- Safe Harbor de-identification removes 18 identifiers, including dates, ZIP codes, photos and record numbers.
- Removing a name alone does not make information de-identified.