Protected health information (PHI)

Protected health information, or PHI, is health information that can be tied to a specific person, and that HIPAA protects. The HIPAA definitions section states it in one sentence: protected health information means individually identifiable health information ¹. The definition also has exclusions, such as certain education records. The word "individually identifiable" is what matters: the information must be linked to a person to count.

What makes health information protected

The rule covers health information that is transmitted or kept in electronic media, and in other forms too. The definition applies whether the information is stored in a database, sent in an email, or written on paper, though the security rules that are most often discussed concern electronic PHI, or ePHI. The HIPAA Security Rule requires an accurate and thorough risk analysis of the risks to the confidentiality, integrity and availability of electronic protected health information ².

Many people assume PHI means a diagnosis alone. It does not. A health fact becomes PHI when it sits next to an identifier, such as a name, a date of birth, a record number or a photo. A note that says a patient has asthma is not PHI until the patient's identity is attached.

An example: a dictated visit note

A nurse dictates "Mrs. Lee, room 4, follow up on her blood pressure medication." The name, the room and the medication are health information linked to a person. That sentence is PHI. The same nurse saying "remind me to restock gloves" is not. Once the words are transcribed, the text file, the audio and any copy of the transcript can each hold PHI, so each place it is stored needs the same protection.

Who may use PHI, and why it matters for dictation

HIPAA permits a covered entity to use or disclose protected health information for its own treatment, which is the permission clinicians rely on when they document care ³. That permission covers the clinician's use. It does not automatically cover a vendor that handles the audio. Such a vendor is usually a business associate, and most vendors that access PHI fall into that group ⁴. That is the reason clinics ask for a business associate agreement before using a cloud dictation service.

The security rules also affect dictation tools directly. The Security Rule's audit controls standard requires mechanisms that record and examine activity in systems that contain or use electronic protected health information ⁵. A dictation product used for clinical notes should show who used it and what was done, so check that before rollout.

What to do before you dictate PHI

Confirm whether your organization is a covered entity or a business associate. Ask the vendor whether it signs a business associate agreement for the product you plan to use. Decide whether the audio should stay on the device, since on-device speech recognition keeps the words on your hardware during recognition. Limit access to transcripts and delete them when they are no longer needed.

Related terms and guides

PHI is one kind of personal data, and a voice recording of a patient can also be biometric data if it is used to identify the speaker. For the clinical rules, read HIPAA-compliant dictation: what makes speech to text safe. For the vendor side, see the enterprise dictation policy guide and the question on whether Windows dictation is HIPAA compliant. This page describes the regulation and is not legal advice.