PHI (protected health information)

Protected health information is individually identifiable health information, in any form, that is created or received by a HIPAA covered entity or business associate and relates to a person's past, present or future physical or mental health, the provision of health care, or payment for it.

The definition is at 45 CFR § 160.103 (eCFR, 45 CFR § 160.103). "Individually identifiable" is broad: the Privacy Rule's de-identification standard at 45 CFR § 164.514 lists 18 identifiers, including IP addresses and device identifiers, that must be removed for data to count as de-identified under the safe-harbour method (eCFR, 45 CFR § 164.514). That list is why ad tech is exposed: a bid request contains an IP address and a device identifier by design, and if it also contains a health-related page URL or segment from a covered entity's property, HHS's tracking guidance treats the combination as PHI (HHS, tracking technologies guidance).

PHI is a HIPAA concept and does not cover health data held by non-covered entities. Washington's My Health My Data Act defines "consumer health data" more broadly and applies to any regulated entity, which is why a pharmacy's front-of-store loyalty data can be outside HIPAA and inside MHMDA at the same time. The glossary entries for HIPAA and MHMDA draw the line.

Example: { "device": { "ip": "203.0.113.1", "ifa": "…" }, "site": { "page": "https://clinic.example/oncology/appointments" } } sent from a covered entity's site is, per HHS's reading, a disclosure of PHI to every bidder that receives it; the same request with "page": "https://clinic.example/" and no IFA is not.

Related: HIPAA, BAA, MHMDA, bid request.

Source: 45 CFR § 160.103; 45 CFR § 164.514; HHS OCR tracking technologies guidance.

1. eCFR, 45 CFR § 160.103
2. eCFR, 45 CFR § 164.514
3. HHS, tracking technologies guidance