PHI is health information tied to an identifiable person, while PII is any information that can identify a person. That difference matters because healthcare data often carries stricter rules, higher breach risk, and heavier privacy duties. A name and phone number may be PII. A name paired with a diagnosis, lab result, insurance claim, or prescription is usually PHI.
TLDR: PII identifies a person; PHI identifies a person and relates to health care, payment, treatment, or medical status. For example, “Maria Lopez, 555-0144” is PII, but “Maria Lopez, diabetes follow-up, claim ID 88421” is PHI. If a clinic exports 5,000 patient records and only 2% are mislabeled as regular customer data, 100 records may be stored, shared, or protected the wrong way. That small error can create large compliance and trust problems.
What PII Means
Personally Identifiable Information, or PII, is data that can identify a specific person. It may identify someone on its own, or it may do so when combined with other details.
Common PII includes:
- Full name
- Home address
- Email address
- Phone number
- Social Security number
- Driver’s license number
- Passport number
- Account numbers
- IP address or device ID in some cases
PII appears in many industries. Banks, schools, retailers, insurers, apps, employers, and government agencies all collect it. The risk is simple: if exposed, PII can support fraud, identity theft, phishing, account takeover, or stalking.
What PHI Means
Protected Health Information, or PHI, is identifiable health information handled by a covered healthcare entity or its business associate in the United States under HIPAA. PHI connects a person’s identity to health care, medical conditions, care delivery, billing, or insurance activity.
PHI can include:
- Medical record numbers
- Lab results
- Diagnoses
- Medication lists
- Appointment details
- Claims information
- Health plan member IDs
- Discharge notes
- Mental health records
- Imaging reports
The same data point can change category based on context. A birth date in a gym membership file may be PII. The same birth date in a cardiology report, linked to a patient name, may be PHI.
PHI vs PII: The Core Difference
The main difference is health context. PII answers, “Can this identify a person?” PHI answers, “Can this identify a person and reveal something about health care or payment for health care?”
PII is broader. It covers many types of personal identity data across many sectors. PHI is more specific. It is a healthcare privacy category connected to regulated health information.
For example:
- PII: “Jordan Smith, 12 Oak Street, Denver.”
- PHI: “Jordan Smith, MRI scheduled for knee injury, 12 Oak Street, Denver.”
- PII: “Employee ID 48392.”
- PHI: “Employee ID 48392, positive lab result, urgent care visit.”
It drives privacy teams crazy that the difference can turn on a few extra words in a spreadsheet column. A file named “contacts.csv” may look harmless until one field contains “oncology follow-up” or “claim denied.”
Why the Distinction Matters
PHI usually needs stricter handling than ordinary PII. In healthcare settings, PHI may require access controls, audit logs, encryption, retention rules, vendor agreements, and breach reporting. PII may also be regulated, but the rules vary by jurisdiction and industry.
Misclassification creates real trouble. If PHI is treated like standard marketing data, it may end up in the wrong email platform, analytics tool, or shared folder. Honestly, it feels like one innocent export can add hours of cleanup when staff must trace where the file went and who opened it.
Key risks include:
- Regulatory penalties: HIPAA violations may lead to investigations and fines.
- Patient harm: Sensitive diagnoses or treatments may become public.
- Identity theft: Medical records often include names, dates of birth, insurance IDs, and addresses.
- Billing fraud: Attackers may use stolen health data to submit false claims.
- Loss of trust: Patients may avoid care if they fear exposure.
Examples of Data That May Be Both
Some information can be both PII and PHI. The label depends on the setting and use. A phone number is PII. A phone number in a patient portal profile is part of a health record system and may be PHI when tied to care.
| Data Type | PII? | PHI? |
|---|---|---|
| Name | Yes | Yes, if tied to health data |
| Email address | Yes | Yes, if used in a patient record or care message |
| Diagnosis | Maybe, if tied to identity | Yes, if identifiable |
| ZIP code | Sometimes | Yes, in many identifiable health datasets |
| Medical record number | Yes | Yes |
HIPAA Identifiers and De-Identification
HIPAA lists 18 identifiers that can make health information identifiable. These include names, geographic details smaller than a state, dates linked to a person, phone numbers, email addresses, Social Security numbers, medical record numbers, account numbers, certificate numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photos, and any other unique identifying code.
Health data can lose PHI status when it is properly de-identified. This means identifiers are removed or the risk of identifying a person is very small. Two common HIPAA methods are the Safe Harbor method and expert determination.
Still, de-identification must be done carefully. Removing names is not enough if rare diagnoses, exact dates, locations, and small group sizes can point back to one person.
How Organizations Should Handle PHI and PII
Organizations should classify data before it moves into storage, analytics, support tools, or vendor systems. The label should follow the data, not sit in a policy binder no one opens.
Basic controls include:
- Data mapping: Identify where PII and PHI are collected, stored, shared, and deleted.
- Access limits: Give staff only the data needed for their work.
- Encryption: Protect data at rest and in transit.
- Audit logs: Track who accessed records and when.
- Vendor checks: Confirm contracts, security practices, and business associate agreements where needed.
- Training: Teach staff how PHI differs from ordinary contact data.
- Retention rules: Keep sensitive data only as long as required.
Common Mistakes
Several mistakes appear again and again. A clinic may upload appointment notes into a general project management tool. A billing team may send claim files through personal email. A startup may track symptom data before realizing that its customers expect healthcare-grade privacy.
The most common errors are:
- Calling all personal data PII and missing the PHI layer.
- Assuming anonymized data is safe after only names are removed.
- Sending spreadsheets with hidden columns that contain diagnoses.
- Using analytics tools without checking whether PHI is permitted.
- Forgetting that screenshots can contain PHI.
FAQ
Is all PHI also PII?
Usually, yes. PHI contains information that identifies a person or can reasonably identify a person. Since PII is identity-related data, identifiable PHI often also qualifies as PII.
Is all PII also PHI?
No. A name, address, or phone number in a retail loyalty account is PII, not PHI. It becomes PHI when connected to health care, treatment, payment, or medical status in a covered context.
Can an email address be PHI?
Yes. An email address alone is often PII. If it appears in a patient portal, appointment reminder, lab result notice, or medical billing record, it may be PHI.
Does HIPAA apply to every app that collects health data?
No. HIPAA applies to covered entities and business associates. Some wellness apps may collect sensitive health data without being covered by HIPAA, though other privacy laws or consumer protection rules may still apply.
What is the safest way to share PHI?
The safest method is an approved secure system with encryption, access controls, logging, and proper recipient checks. Regular email, shared public links, and unmanaged spreadsheets create avoidable risk.
What should happen if PHI is sent to the wrong person?
The organization should follow its incident response process right away. That often includes containment, risk assessment, documentation, notice to privacy staff, and possible breach notification depending on the facts.
