Understanding HIPAA and PHI: 18 Identifiers with Examples (2025)

HIPAA (Health Insurance Portability and Accountability Act) governs the protection of PHI (Protected Health Information) to ensure patient privacy and security. Organizations handling PHI must comply with HIPAA regulations to prevent breaches, legal penalties, and reputational damage.

With cyber threats targeting healthcare increasing by 60% in 2024, securing PHI is critical for HIPAA compliance.

What Qualifies as PHI Under HIPAA?

PHI is any individually identifiable health information created, received, stored, or transmitted by a HIPAA-covered entity.

PHI Must Meet Three Criteria:

Identifies an individual (directly or indirectly).

Relates to health conditions, treatments, or payments.

Is managed by a HIPAA-covered entity or business associate.

18 HIPAA Identifiers of PHI (With Examples)

The U.S. Department of Health and Human Services (HHS) defines 18 identifiers that classify health information as PHI. If data contains any of these, it falls under HIPAA compliance.

• Names – Example: John Smith, Jane Doe
• Geographic Data – Example: Home addresses, ZIP codes (first three digits may be permitted)
• Dates (Other Than Year) – Example: Birthdates, admission dates, discharge dates
• Phone Numbers – Example: (555) 123-4567
• Fax Numbers – Example: (555) 987-6543
• Email Addresses – Example: [email protected]
• Social Security Numbers (SSNs) – Example: 123-45-6789
• Medical Record Numbers – Example: MRN-987654321
• Health Plan Beneficiary Numbers – Example: Medicare ID, insurance policy numbers
• Account Numbers – Example: Patient billing account: 123456789
• Certificate or License Numbers – Example: Medical license: MD123456
• Vehicle Identifiers & Serial Numbers – Example: License plate: XYZ-1234
• Device Identifiers & Serial Numbers – Example: Pacemaker SN: A1B2C3D4
• Web URLs – Example: www.hospitalpatientportal.com
• IP Addresses – Example: 192.168.1.1
• Biometric Identifiers – Example: Fingerprints, retinal scans, voice recognition
• Full-Face Photos & Comparable Images – Example: Patient ID badge photos, diagnostic images with faces
• Any Unique Identifying Number, Code, or Characteristic – Example: Custom patient codes, unique study identifiers

Get a demo of Risk Cognizance HIPAA compliance Solutions

HIPAA vs. PII: What’s the Difference?

While Personally Identifiable Information (PII) is any data identifying a person, PHI specifically relates to health information and is protected under HIPAA.

Key Differences

Example: A name and phone number alone are PII, but when linked to medical treatment, they become PHI under HIPAA.

How to Protect PHI and Ensure HIPAA Compliance

Organizations handling PHI must implement strong security measures to maintain HIPAA compliance.

Implement strict access controls

• Use multi-factor authentication (MFA) for PHI access.
• Restrict PHI access to authorized personnel.

Encrypt PHI in storage and transmission

• Apply encryption for emails, databases, and backups containing PHI.

Conduct regular risk assessments

• Identify vulnerabilities to maintain HIPAA compliance.

Provide HIPAA training

• Educate employees on PHI security policies.

Use AI-powered compliance tools

• Automate HIPAA compliance monitoring and risk management.

Top AI-Powered Platforms for PHI Compliance

Risk Cognizance vCISO Platform

Risk Cognizance is an AI-driven vCISO platform that provides businesses with strategic cybersecurity leadership, governance, risk management, and compliance (GRC) capabilities in a unified interface.

Features:

• AI-powered cybersecurity compliance software
• Enterprise risk management (ERM) tools
• Third-party risk management
• Attack surface management
• Dark web monitoring
• Cloud security and compliance assessments
• Automated security policy management
• Audit and compliance reporting
• Regulatory and compliance support (SOC 2, NIST, CMMC, GDPR, ISO 27001, DORA & NIS2.

Why Choose Risk Cognizance?:

• Automated HIPAA compliance monitoring
• AI-powered threat detection
• PHI encryption and security assessments
• Dark web monitoring for leaked PHI
• Attack surface protect and monitoring for leaked PHI
• Cloud sssessment protect and monitoring for leaked PHI
• Recognized as a top compliance platform for healthcare security.
• Reduces HIPAA compliance costs by 40% through automation.

Why Businesses Choose Risk Cognizance

• Recognized as a top GRC platform for assurance leaders on Gartner Peer Insights
• Automated compliance and risk assessments reduce audit preparation time by 65%
• 24/7 security monitoring with AI-driven threat detection and compliance insights

Who Uses It?

• DoD contractors seeking CMMC compliance
• Enterprises and MSSPs needing a vCISO framework
• Mid-sized companies without a full-time CISO

Why PHI Compliance Matters Under HIPAA

Failure to protect PHI can result in HIPAA violations, regulatory fines, and legal risks. To ensure compliance, organizations must:

• Implement strong security measures to protect PHI.
• Automate compliance tracking using AI-powered solutions.
• Educate employees on best practices for handling PHI.

With AI-driven HIPAA compliance platforms like Risk Cognizance, organizations can automate PHI security, prevent breaches, and ensure regulatory compliance.

Need a HIPAA compliance solution? Contact us today.