What is PHI (Protected Health Information)?
PHI is any individually identifiable health information held or transmitted by a HIPAA-covered entity, including demographic data, billing records, and treatment notes.
PHI includes the 18 'Identifiers' defined by HIPAA: name, address, dates relating to the individual, phone numbers, fax numbers, email, SSN, MRN, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photos, and any other unique identifying number, characteristic, or code.
Removing all 18 makes data 'de-identified' and outside HIPAA - but auditors apply this strictly; a partial removal still counts as PHI.
Storing PHI on personal devices, in personal email, or in any tool without a BAA is a HIPAA violation regardless of intent.
Why it matters for Florida small business
Any document that names a patient and mentions a diagnosis is PHI - including a sticky note left at the front desk.
What to do
Audit your data-handling practices: where is PHI stored, who can access it, is each storage location covered by a BAA. The HIPAA Starter Kit walks you through it.