Protected Health Information (PHI)

Protected Health Information (PHI) is defined in HIPAA (45 CFR 160.103) as individually identifiable health information held or transmitted by a covered entity (health plan, healthcare clearinghouse, healthcare provider that transmits health information electronically) or its business associate. It covers past, present and future physical or mental health, provision of healthcare, and payment for healthcare, where the information identifies the individual or there is a reasonable basis to believe it can be used to identify them.

PHI is not a privacy-regime-neutral concept; outside the US it is treated under the general health-data provisions of each jurisdiction's privacy law. GDPR classifies health data as 'special category' under Article 9 with stricter processing conditions. India's DPDP Act does not create a separate sensitive-data category — health data is personal data with the same protections — though Rule 10 adds specific protections where the Data Principal is a child or person with disability. For global healthcare organisations, mapping PHI under HIPAA to Article 9 special data under GDPR to personal data under DPDP is a baseline data-governance exercise.