PHI

Protected Health Information is any individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate, protected under HIPAA regulations.

Protected Health Information is any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. Under HIPAA, PHI is the information you are legally required to protect. PHI includes obvious things like patient names, diagnoses, treatment records, and lab results. But it also includes less obvious identifiers: dates of birth, Social Security numbers, email addresses, phone numbers, medical record numbers, health plan beneficiary numbers, and even photographs. If information can be used to identify a specific individual and it relates to their health condition, healthcare services, or payment for healthcare, it is PHI. In credentialing, PHI comes into play in several ways. Your credentialing application contains your personal information, which the payer must protect. Patient information that you share with payers during claims processing, prior authorization, and quality reviews is all PHI. And if you are part of a peer review or credentialing committee that reviews other providers' patient outcomes, that data is PHI too. Electronic PHI gets additional protections under the HIPAA Security Rule. You need technical safeguards like encryption, access controls, and audit logs. You need physical safeguards like locked offices and secure workstations. And you need administrative safeguards like workforce training, risk assessments, and incident response plans. A PHI breach can result in significant penalties and reputational damage. If your practice experiences a breach affecting 500 or more individuals, you must notify HHS, the affected individuals, and the media. The breach gets posted on the HHS "Wall of Shame" website for public viewing.