Overview
Protected Health Information is any individually identifiable health data created or handled by a covered entity or its business associate – medical records, payment history, even a name paired with a diagnosis. HIPAA defines 18 specific identifiers that, combined with health information, turn ordinary data into PHI subject to strict handling rules.
Why it matters
Knowing exactly what counts as PHI determines what a system has to encrypt, log, and restrict – treating everything as equally sensitive wastes engineering effort, while under-classifying data creates real compliance exposure. Analytics and product teams especially tend to underestimate how easily de-identified data becomes PHI again once it’s combined with other fields.
How Dotcode applies it
We map PHI flows through a system during architecture planning – what touches it, what stores it, what can be de-identified – before deciding on encryption and access design, using the same handling principles covered in our HIPAA Compliance glossary entry.
Read our Healthcare Data Security Best Practices guide
