What Is An Example Of Phi Types And Identifiers is a request for records that connect health facts to a person. A lab result labeled with Jordan Lee’s name and medical record number illustrates Protected Health Information (PHI), as does a diabetes diagnosis tied to an appointment date and treating facility.
This guide explains the 18 PHI identifier categories, compares PHI with PII and ePHI, and shows how de-identification works. It serves privacy professionals, healthcare staff, researchers, and anyone handling identifiable health records.
How Protected Health Information Connects to Identity
A diagnosis becomes individually identifiable when you connect it to a direct identifier such as a full name or medical record number. The health fact supplies the clinical context, while the identifier links that fact to Jordan Lee or another specific person.
You do not need a diagnosis for a record to contain PHI. A bill tied to an account, a prescription linked to a patient, or an appointment record connected to a clinic can reveal enough about your identity and healthcare activity to qualify.
Health facts and identifying details
A medical record commonly contains two layers. The clinical layer includes symptoms, test results, procedures, medications, and diagnoses; the identification layer includes names, addresses, phone numbers, account numbers, and other identifying details.
You can’t classify a record by one field alone. A full-face photograph, device serial number, or unique account number may identify someone by itself, while an admission date, rare condition, and small clinic name may identify someone when combined.
Where protected records appear
PHI can appear in electronic health records, paper charts scanned into a document system, patient portals, emails, text messages, billing files, clinical images, and research datasets. A photograph exported from a hospital workstation may retain metadata or a filename containing a patient name.
Covered entities, including healthcare providers, health plans, and certain healthcare clearinghouses, can create, receive, maintain, or transmit this information. A business associate performs functions involving PHI on behalf of a covered entity, such as hosting a patient portal or handling records for a billing service.
Location alone does not create a HIPAA obligation. A private diary entry may describe health information, but whether it is PHI depends on its context, the relationship among its details, and whether the information is individually identifiable.
The 18 PHI Identifier Categories
The HIPAA Privacy Rule identifies 18 categories that may reveal identity, although Safe Harbor treats the categories differently because it excludes certain location data and permits limited retention of ages and dates.
- Names: A full name or family name can directly connect a diagnosis, prescription, or bill to a person.
- Geographic subdivisions: A street address, neighborhood, county, or equivalent location can narrow the pool of possible patients.
- Date elements: A birth date, admission date, discharge date, or death date can distinguish one patient from another.
- Telephone numbers: A patient’s phone number can connect appointment reminders or laboratory calls to that person.
- Fax numbers: A dedicated clinical fax number can appear on records sent between a hospital and a physician.
- Email addresses: An address used for lab reports or portal access can link electronic health information to an account holder.
- Social Security numbers: A Social Security number can directly identify a patient when placed in an insurance or billing form.
- Medical record numbers: A number such as MR-2048 can connect a diagnosis, medication list, or test result to one chart.
- Health plan numbers: A subscriber or member number can connect claims and coverage records to a policyholder.
- Account numbers: A billing, laboratory, or portal account number can function as a unique reference within an organization.
- Certificate or license numbers: A clinician, facility, vehicle, or professional certificate can appear in an authorized record.
- Vehicle identifiers: A vehicle identification number or license plate can connect an accident-related record to its owner.
- Device identifiers: A serial number, implanted device identifier, or phone number can connect a clinical event to equipment or its user.
- Web URLs: A portal link containing a patient identifier can expose health information when copied into another system.
- IP addresses: A network address can connect access logs or portal activity to a particular device or account, subject to available identifying information.
- Biometric identifiers: A fingerprint, voiceprint, or other distinctive biological pattern can identify a person without a written name.
- Full-face photographs: An image of Jordan Lee’s face can connect visible features to an accompanying diagnosis or admission date.
- Other unique identifiers: A characteristic code, rare condition, or account number can identify someone when ordinary details are insufficient.
| Record element | Example | Identification effect |
|---|---|---|
| Direct identifier | Jordan Lee | Names the individual without supporting details |
| Record number | MR-2048 | Connects a clinical entry to one patient chart |
| Date and place | March 14, 2026, in a small county | Narrows identity when paired with a facility and diagnosis |
| Electronic identifier | Portal URL or IP address | Can connect digital activity to an account or device |
Direct and indirect identifiers
A direct identifier, such as a full name, reveals identity by itself. An indirect identifier may need other details, but a rare diagnosis, exact service date, and small treating facility can still make re-identification reasonably possible.
Your review must evaluate the record as a complete package. Removing Jordan Lee’s name does not solve the problem if MR-2048, a full-face photograph, and the admission date remain in the same clinical note.
Review the whole record, including attachments, filenames, and metadata, rather than checking only the most visible field.
How PHI Differs From PII and ePHI
Personally Identifiable Information (PII) is broader than PHI, while Electronic Protected Health Information (ePHI) describes PHI in electronic form. A home address linked to a person may be PII without revealing health information; the same address beside a diabetes diagnosis may also be PHI.
| Term | Defining elements | Fictional example |
|---|---|---|
| PHI | Individually identifiable information concerning health, care, or payment | Jordan Lee’s name beside a laboratory result |
| PII | Information that identifies or can be linked to an identifiable person | Alex Rivera connected to a home address |
| ePHI | PHI stored or transmitted in electronic form | An electronic lab PDF in a patient portal |
| De-identified information | Information processed under Safe Harbor or Expert Determination | A research dataset with covered identifiers removed |
Why system location does not create PHI
Information does not become PHI simply because a hospital stores it. You must still evaluate whether it concerns health, care, or payment and whether it relates to an identifiable person.
A de-identified statement that 12% of a study group had diabetes may be sensitive, but it may not be individually identifiable PHI. Adding a patient name, unique test number, or recognizable hospital encounter can change that result.
What electronic form changes
Electronic form changes how information is stored, accessed, copied, and transmitted. A scanned paper chart saved to a shared drive is ePHI because the image and its contents exist electronically, even if the original document was printed.
Your security review must consider portal access, email forwarding, file permissions, and transmission paths. The same diagnosis can present different operational risks on paper and in an electronic system, although the underlying PHI classification remains unchanged.
Real records show why context matters because scattered identifiers can become identifying when systems link them across workflows.
Identifier Combinations in Real Records
Consider fictional records for Jordan Lee, born February 3, 1980, with medical record number MR-2048. A type 2 diabetes entry at Lakeside Medical Center combines a name, birth date, record number, diagnosis, and facility, making every field relevant to your review.
Removing the name does not automatically remove the identification risk. The exact birth date, facility, diagnosis, and MR-2048 may still allow someone with access to other information to recognize the individual.
Examples across care settings
You will encounter PHI in several ordinary workflows, each with a different combination of clinical facts and identifiers.
- Portal message: Alex Rivera’s symptom description includes a name, portal account, and March 14 appointment date.
- Prescription history: A medication list connected to patient number RX-771 identifies treatment for that person.
- Laboratory report: A hemoglobin result includes a specimen number and facility that connect the test to one patient.
- Appointment schedule: A service date, clinic, and patient phone number reveal that a person received care.
- Billing statement: A patient name and charge date connect a $240 laboratory service with that person’s account.
- Clinical image: A scan may show a face, birth date, accession number, or identifying information embedded in the file.
Fictional examples can teach the same privacy concepts without exposing a real person. Your training material should replace names, addresses, account numbers, photographs, and screenshots rather than relying on deletion alone.
When De-Identification Removes PHI Protection
De-identification changes the status of PHI only after a recognized process removes or obscures identifying information. Replacing one name with initials usually fails because an exact date, facility, and unique number may still point to the same patient.
Safe Harbor removes covered identifiers
The Safe Harbor method requires removal of identifiers specified in the HIPAA Privacy Rule, subject to its limited exceptions for age, dates, and geographic information. The person applying the method must also have no actual knowledge that the remaining information could identify an individual.
Safe Harbor requires careful treatment of names, street-level geography, contact details, record numbers, account numbers, device identifiers, URLs, IP addresses, biometrics, and full-face photographs. A dataset may pass only after every applicable category and contextual condition has been addressed.
Expert Determination evaluates residual risk
Expert Determination relies on a qualified expert to evaluate the probability that available information could identify a person. The expert assesses the dataset’s content, context, accessibility, and relationship to other information.
You cannot replace this method with a cosmetic masking step. If initials, dates, or a rare condition still create a meaningful identification risk, your expert evaluation must determine whether the record qualifies as de-identified.
An expert evaluation can catch residual risk only after reviewers know which de-identification mistakes routinely leave records exposed.
Mistakes That Can Expose PHI Unintentionally
A single obvious name is not the only exposure risk. Attachments, spreadsheet columns, email subjects, document properties, and filenames can restore identity after the main page appears anonymized.
A practical privacy review
Before you share, document, or publish an example, your review should cover the record’s content, context, and file structure.
- Inspect text fields: Search for names, addresses, phone numbers, email addresses, and unique account numbers.
- Check dates and places: Review birth dates, admission dates, clinic names, and narrow geographic details.
- Remove file metadata: Check screenshot names, document titles, author fields, URLs, and embedded device details.
- Inspect attachments: A PDF labeled “final_report.pdf” may accompany a note containing MR-2048 and a full-face image.
- Review surrounding records: Spreadsheet columns and email subjects can disclose identifiers outside the main document.
- Use fictional material: Invented names and numbers can demonstrate the lesson without exposing someone else’s health information.
Your review should treat the file and its context as one disclosure risk. Deleting a name from a report that retains a unique number, exact date, recognizable image, and facility may leave the patient identifiable.
Your Privacy Decision for a Complete Record
Your final decision should follow the record’s facts rather than its location or formatting. Health-related content, identifying detail, organizational obligations, and the way the information will be used determine how you handle it.
For an example document, separate the clinical content from identifying fields, inspect every attachment, and use fictional data. When legal or organizational consequences remain unclear, your next step is to consult a qualified privacy or compliance professional.
Key Takeaways
A practical review rests on one rule: you assess identifying detail alone and in combination. Names and medical record numbers are familiar examples, but dates, locations, device data, images, and unique characteristics can also connect health information to a person.
Your record may stop qualifying as protected PHI after de-identification under Safe Harbor or Expert Determination, not after a single field is hidden. The applicable method, complete dataset, and residual identification risk determine the outcome.
FAQ
What is an example of PHI type and identifier?
A patient name connected to a laboratory result is an example because the result contains health information and the name identifies the person. A diagnosis beside medical record number MR-2048 works for the same reason. You can recognize both examples by checking the connection between the health fact and the identifier.
What are the 18 types of identifiers protected under HIPAA?
The 18 categories cover names, geographic subdivisions, date elements, telephone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, account numbers, certificate or license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs, and other unique identifying characteristics. Your Safe Harbor review must apply the category rules and limited exceptions correctly.
Why is a diagnosis considered PHI when linked to an identifier?
A diagnosis is considered PHI when an identifier lets someone connect that health fact to a particular person. A name, medical record number, exact admission date, or combination of facility and rare condition can provide that connection. You should evaluate the diagnosis and identifiers as one record.
What is the difference between PHI, PII, and ePHI?
PII is a broader privacy term for information that identifies or can be linked to a person. PHI concerns individually identifiable information connected with health, care, or payment, while ePHI is PHI stored or transmitted electronically. Your classification depends on the information’s content, context, and format.
Does information inside a healthcare system automatically qualify as PHI?
No. Information inside a healthcare system is not automatically PHI merely because a hospital stores it. The information must concern health, care, or payment and relate to an identifiable person, although a system’s covered-entity or business-associate role affects the applicable privacy obligations.
When is PHI no longer considered protected after de-identification?
PHI is no longer individually identifiable after de-identification under Safe Harbor or Expert Determination. Safe Harbor requires removal of covered identifiers and a lack of actual knowledge that the remaining information could identify the person; Expert Determination requires a qualified expert to find that identification risk is very small.
