{"id":745,"date":"2018-05-04T09:59:24","date_gmt":"2018-05-04T09:59:24","guid":{"rendered":"https:\/\/az.research.umich.edu\/medschool\/document\/protected-health-information-phi\/"},"modified":"2026-03-30T10:34:27","modified_gmt":"2026-03-30T14:34:27","slug":"protected-health-information-phi","status":"publish","type":"document","link":"https:\/\/az.research.umich.edu\/medschool\/guidance\/protected-health-information-phi\/","title":{"rendered":"Protected Health Information (PHI)"},"template":"","categories":[24],"tags":[],"content-type":[41],"topic":[45],"update-type":[],"class_list":["post-745","document","type-document","status-publish","hentry","category-institutional-review-boards-irbmed","content-type-guidance","topic-hipaa-protected-health-information"],"acf":{"use_legacy_editor":true,"updated_date":"2020-08-10 14:45:00","update_notice":false,"author":"IRBMED","summary":"<a href=\"https:\/\/privacyruleandresearch.nih.gov\/pr_07.asp\">Protected Health Information (PHI)<\/a>\u00a0is <a class=\"gtip\" href=\"\/medschool\/glossary\/individually-identifiable-health-information\">individually identifiable health information <\/a>held or maintained by\u00a0<a class=\"gtip\" href=\"\/medschool\/glossary\/covered-entity\">covered entities<\/a>, or by business associates acting for the covered entity. PHI is subject to\u00a0<a href=\"https:\/\/privacyruleandresearch.nih.gov\/pr_07.asp\">HIPAA Privacy Rule<\/a>\u00a0protections.\u00a0<a href=\"\/medschool\/guidance\/hipaa\">HIPAA<\/a>\u00a0Privacy Rule permits researchers to access and use PHI when necessary to conduct research, with certain restrictions.","button_links":null,"related_content":[744],"legacy_path":"protected-health-information-phi","legacy_node_id":285,"legacy_related_nids":"284","legacy_content_section":[{"legacy_section_type":"heading","legacy_heading":"Individually Identifiable Health Information","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"<a class=\"gtip\" href=\"\/medschool\/glossary\/individually-identifiable-health-information\">Individually identifiable health information<\/a> is information (including demographic information) that\r\n<ol>\r\n \t<li>is related to\r\n<ul>\r\n \t<li>past, present, or future physical or mental health or condition of the individual,\r\n<strong>and\/or<\/strong><\/li>\r\n \t<li>health care provided to the individual,\r\n<strong>and\/or<\/strong><\/li>\r\n \t<li>past, present, or future payment for health care provided to the individual;<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ol>\r\n<strong>and<\/strong>\r\n<ol start=\"2\">\r\n \t<li>identifies an individual directly or indirectly,\u00a0or\u00a0there is a reasonable basis to believe that the information could be used to identify the individual.<\/li>\r\n<\/ol>\r\n<strong><em>ref.<\/em><\/strong>\u00a0 OCR guidance <a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html\">De-Identification Methods<\/a>, 1.1","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"HIPAA Identifiers","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"Health information is considered to be <a class=\"gtip\" href=\"\/medschool\/glossary\/individually-identifiable-health-information\">individually identifiable health information<\/a> if <strong>any <\/strong>of the following identifiers are <strong>in<\/strong>cluded:\r\n<ol>\r\n \t<li>Name<\/li>\r\n \t<li>Geographic subdivisions smaller than a state.<\/li>\r\n \t<li>All elements of dates (except year) for dates that are directly related to an individual, and all ages over 89 and all elements of dates (including year) indicative of such age<\/li>\r\n \t<li>Telephone numbers<\/li>\r\n \t<li>Fax numbers<\/li>\r\n \t<li>Email addresses<\/li>\r\n \t<li>Social security numbers<\/li>\r\n \t<li>Medical record numbers<\/li>\r\n \t<li>Health plan numbers<\/li>\r\n \t<li>Account numbers<\/li>\r\n \t<li>Certificate or license numbers<\/li>\r\n \t<li>Vehicle identification\/serial numbers, including license plate numbers<\/li>\r\n \t<li>Device identification\/serial numbers<\/li>\r\n \t<li>Universal Resource Locators (URLs)<\/li>\r\n \t<li>Internet protocol (IP) addresses<\/li>\r\n \t<li>Biometric identifiers, including finger and voice prints<\/li>\r\n \t<li>Full face photographs and comparable images<\/li>\r\n \t<li>Any unique identifying number, characteristic, or code<\/li>\r\n<\/ol>\r\n<strong><em>Note on #2<\/em><\/strong>: A dataset held by a <a class=\"gtip\" href=\"\/medschool\/glossary\/covered-entity\">covered entity<\/a> <strong>is<\/strong> considered to include Protected Health Information (PHI) if it includes ZIP codes, counties, census tracts, and other equivalents.\r\n\r\n<strong><em>Note on #3<\/em><\/strong>: A dataset held by a covered entity <strong>is<\/strong> considered to include PHI if it includes the day, month, or any other information that is more specific than the year of an event. For instance, \"January 1, 2009\" and \"January 2009\" are both considered to contain PHI. Not only birth or death dates, but also dates of service (appointment, biopsy, surgery, etc.) are considered dates \u201cdirectly related to the individual.\u201d\r\n\r\n<strong><em>Note on #18<\/em><\/strong> \u2013 According to OCR <a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html#safeharborguidance\">Guidance on Satisfying the Safe Harbor Method<\/a>, examples include\r\n<ul>\r\n \t<li><em>identifying number<\/em> - study-specific subject identification numbers,<\/li>\r\n \t<li><em>identifying code<\/em> - barcodes designed to be unique for each patient for tracking purposes<\/li>\r\n \t<li><em>identifying characteristic<\/em> - anything that distinguishes an individual and allows for identification; this may also be called an \u201cindirect identifier.\u201d<\/li>\r\n<\/ul>\r\nConversely, health information is considered to be <a href=\"\/medschool\/document\/de-identified-data-sets\/\">HIPAA de-identified<\/a> if <strong>both<\/strong>\r\n<ul>\r\n \t<li>All 18 identifiers listed above are removed,\u00a0<strong>and<\/strong><\/li>\r\n \t<li>The\u00a0covered entity\u00a0or its workforce, e.g., the\u00a0principal investigator, has no actual knowledge that the remaining information could be used alone or in combination with other information to identify the individual who is the subject of the information<\/li>\r\n<\/ul>\r\nPHI does not cover employment records that a covered entity maintains in its capacity as an employer.\u00a0 PHI may also not include education and certain other records subject to the <a href=\"https:\/\/studentprivacy.ed.gov\/faq\/what-ferpa\">Family Educational Rights and Privacy Act (FERPA)<\/a>. For more information about University responsibilities under FERPA, see\u00a0<a href=\"https:\/\/ro.umich.edu\/student-records\/student-rights-records\">University Registrar FERPA webpage<\/a>.","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"heading","legacy_heading":"References","legacy_subheading":"","legacy_section_text":"","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null},{"legacy_section_type":"text_area","legacy_heading":"","legacy_subheading":"","legacy_section_text":"OCR guidance\u00a0<a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/special-topics\/de-identification\/index.html\">De-Identification Methods<\/a>\r\n\r\nMichigan Medicine Policies <em>(requires level-2 login)<\/em>\r\n<ul>\r\n \t<li><a href=\"https:\/\/michmed-administration.policystat.com\/policy\/6450709\/latest\/\">01-04-300<\/a> <a class=\"gtip\" href=\"\/medschool\/glossary\/privacy\">Privacy<\/a> and Security Concepts and Definitions<\/li>\r\n \t<li><a href=\"https:\/\/michmed-administration.policystat.com\/policy\/7304325\/latest\/\">01-04-360<\/a>\u00a0Use of Protected Health Information (PHI) in Research<\/li>\r\n<\/ul>","legacy_media_position":"","legacy_media_file":"","legacy_media_url":"","legacy_glossary_term":"","legacy_glossary_nids":"","legacy_resource":"","legacy_resource_nids":"","legacy_buttons":null}],"update_notice_type":[],"update_notice_start":"","update_notice_end":"","update_notice_text_blocks":null,"global_contact_block":false,"contact_name":"","contact_email":"","contact_additional_info":"Contact us at\u00a0<a href=\"mailto:irbmed@umich.edu\">irbmed@umich.edu<\/a>\u00a0or 734-763-4768 \/ (Fax 734-763-1234)\r\n\r\n2800 Plymouth Road, Ann Arbor, MI 48109-2800\r\n\r\n<p>A <a href=\"https:\/\/medresearch.umich.edu\/office-research\/about-office-research\/our-units\/institutional-review-boards-irbmed\/irbmed-contacts-roster#irbmed-staff\">list of IRBMED staff<\/a> is available at our website.<\/p>\r\n\r\nEdited By: <a href=\"mailto:larkspur@umich.edu\">larkspur@umich.edu<\/a>\r\nLast Updated: March 30, 2026 10:30AM","global_contact_block_select":null},"_links":{"self":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document"}],"about":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/types\/document"}],"version-history":[{"count":1,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/745\/revisions"}],"predecessor-version":[{"id":1928,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/745\/revisions\/1928"}],"acf:post":[{"embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/document\/744"}],"wp:attachment":[{"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/media?parent=745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/categories?post=745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/tags?post=745"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/content-type?post=745"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/topic?post=745"},{"taxonomy":"update-type","embeddable":true,"href":"https:\/\/az.research.umich.edu\/medschool\/wp-json\/wp\/v2\/update-type?post=745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}