Protected Health Information (PHI) includes any individually identifiable health information transmitted or maintained in any form or medium (e.g., electronic, paper, oral) by a covered entity or its business associate.
Individually identifiable health information is information, including demographic data, that relates to:
- the individual’s past, present or future physical or mental health or condition,
- the provision of health care to the individual, or
- the past, present, or future payment for the provision of health care to the individual, and
- that identifies the individual, or
- for which there is a reasonable basis to believe it can be used to identify the individual.