Which statement best defines PHI (protected health information)?

• A. De-identified health data
• B. Only diagnoses in the medical record
• C. Identifiable health information linked to an individual
• D. Insurance policy numbers without other identifiers

Answer: (C)

PHI refers to health information that can identify a person and relates to that person’s health status, healthcare, or payment for care. It includes elements like names, dates, contact details, diagnoses, treatment information, test results, and billing data when they are linked to an identifiable individual. Data that has been de-identified—stripped of identifying information—is not PHI. The idea that PHI is only diagnoses is too narrow, since PHI encompasses a broad range of health data, not just diagnoses. An insurance policy number by itself, without any health information attached, does not constitute PHI. The essence is identifiable health information tied to an individual.