---
title: "What Is PHI? Protected Health Information Definition"
description: "PHI is identifiable health, care or payment data held by a HIPAA covered entity or its business associate. Examples, exclusions, and how Cuvo handles it."
canonical: "https://cuvo.co/glossary/protected-health-information"
last-updated: "Oct 26, 2026"
---
**Definition:** Protected health information (PHI) is individually identifiable information about a person's health, care or payment for care that HIPAA protects when a covered entity or its business associate holds or transmits it, in any form or medium.

# What is protected health information (PHI)?

Protected health information is the data HIPAA exists to protect, and whether a record counts depends on what it says and who holds it. In a telehealth program, intake answers, prescriptions and lab results are PHI at the practice. Cuvo Health keeps that data on HIPAA-compliant infrastructure under a business associate agreement on every plan.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

Protected health information (PHI) is individually identifiable health information that HIPAA protects when a covered entity or its business associate holds or transmits it, whether electronically, on paper or orally. Under 45 CFR 160.103 the information must relate to a person's past, present or future physical or mental health, the care they receive, or payment for that care, and it must identify the person or give a reasonable basis to identify them. Employment records held by a covered entity as an employer, education records under FERPA and records of people dead more than 50 years are excluded, and de-identified data is not PHI. Cuvo Health runs intake, charts and prescriptions on HIPAA-compliant infrastructure under a business associate agreement on every plan and verifies patient identity at intake.

**At a glance**
- What it is: Identifiable health, care or payment information held by a covered entity or business associate
- Defined in: 45 CFR 160.103
- Any form: Electronic, paper or oral; the electronic kind is called electronic PHI, or ePHI
- Not PHI: De-identified data (45 CFR 164.514), employer-held employment records, FERPA education records
- On Cuvo: Intake, charts and prescriptions on HIPAA-compliant infrastructure under a BAA on every plan

**Is it PHI? Common data in a telehealth program**

| Data | PHI? | Why |
| --- | --- | --- |
| **Intake answers tied to a name** | Yes, at the practice or its platform | Identifiable health information held for a covered entity |
| **A prescription or refill date** | Yes | Relates to the care a named patient receives |
| **A lab result** | Yes | Describes the health condition of an identified person |
| **An email list from the brand's own store** | Usually not, when the brand is not a covered entity or business associate | HIPAA reaches covered entities and business associates; FTC and state health data rules may still apply |
| **The same email tied by the practice to a program or prescription** | Yes | An email address is one of the 18 identifiers, and here it is linked to care |
| **De-identified, aggregated reporting** | No | 164.514 removes the 18 identifiers or relies on an expert determination |

## 01. What are examples of PHI in a telehealth program?

Any identifier becomes PHI when a covered entity or business associate holds it linked to health information. 45 CFR 164.514(b)(2) lists the 18 identifiers that must come out before data counts as de-identified under the safe-harbor method: names, geographic units smaller than a state, every element of a date except the year, phone and fax numbers, email addresses, Social Security numbers, medical record, health plan and account numbers, license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs and any other unique identifying code. In telehealth that covers a patient's intake, visit notes, prescriptions, lab results, refill history and messages with providers.

## 02. Is a customer email address PHI?

It depends on who holds it and what it is tied to. A list of names and emails a supplement brand built from its own store is not PHI when the brand is neither a covered entity nor a business associate; the same email becomes PHI once the practice or its platform links it to a program, a prescription or a refill date. That line matters most for marketing tools and ad pixels. On Cuvo, the brand owns its customer list and business records, and the clinical record sits on Cuvo's HIPAA-compliant infrastructure under the business associate agreement.

## 03. How is PHI different from consumer health data?

Whether data is PHI turns on who holds it; consumer health data under Washington's My Health My Data Act is defined by what the data reveals, whoever holds it, and RCW 19.373.100 exempts PHI from that law. The same person's information can therefore be PHI at the treating practice and consumer health data in a brand's storefront analytics, with different consent and disclosure rules for each.

## 04. Who may see PHI on a telehealth platform?

HIPAA's minimum necessary standard in 45 CFR 164.502(b) requires covered entities and business associates to make reasonable efforts to limit each use, disclosure or request to the minimum needed for its purpose, with exceptions such as disclosures to a provider for treatment and disclosures to the patient. In practice that means role-based access: the provider sees the chart, the support agent sees what the ticket needs, and the marketing team sees no clinical data at all. This is general information, not legal advice.

**Primary sources**
- [45 CFR 160.103: protected health information, individually identifiable health information](https://www.ecfr.gov/current/title-45/section-160.103): eCFR, checked Oct 26, 2026
- [45 CFR 164.514: de-identification and the 18 identifiers](https://www.ecfr.gov/current/title-45/section-164.514): eCFR, checked Oct 26, 2026
- [45 CFR 164.502(b): minimum necessary](https://www.ecfr.gov/current/title-45/section-164.502): Limits on each use and disclosure
- [RCW 19.373: Washington My Health My Data Act](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true): PHI exemption in RCW 19.373.100

## Frequently asked questions

**Q: What is PHI?**

A: PHI, or protected health information, is individually identifiable information about a person's health, care or payment for care that a HIPAA covered entity or its business associate holds or transmits, as defined in 45 CFR 160.103. On Cuvo, PHI from intake, charts and prescriptions sits on HIPAA-compliant infrastructure under a business associate agreement on every plan.

**Q: What are examples of PHI?**

A: A patient's intake answers, diagnosis, prescriptions, lab results, visit dates and messages with a provider, along with identifiers such as a name, email address, phone number or IP address linked to that care. On Cuvo, that clinical data sits on HIPAA-compliant infrastructure under a business associate agreement on every plan.

**Q: Is an email address PHI?**

A: Only when a covered entity or business associate holds it linked to health information, such as a program, prescription or refill date; a brand's own store list is usually not PHI. On Cuvo, the brand owns its customer list, and the clinical record sits on HIPAA-compliant infrastructure under the business associate agreement.

**Q: PHI vs PII: what is the difference?**

A: PII, personally identifiable information, is a general term for data that identifies a person; PHI is HIPAA's term for identifiable health, care or payment information held by a covered entity or business associate. On Cuvo, PHI is handled on HIPAA-compliant infrastructure under a business associate agreement on every plan.

**Q: Does a telehealth brand handle PHI?**

A: The practice that treats patients and the platform that serves it handle PHI; a brand handles it only where its own tools receive clinical data from that practice. Cuvo Health keeps intake, charts and prescriptions on its HIPAA-compliant platform under a business associate agreement; which fields a brand syncs to its own marketing tools is a decision to make with counsel.

**Related pages**

- [Business associate agreement (BAA)](/glossary/business-associate-agreement): The contract every vendor handling PHI signs
- [Covered entity (HIPAA)](/glossary/covered-entity): Who HIPAA regulates directly
- [Consumer health data (Washington)](/glossary/consumer-health-data): The state-law category for health data outside HIPAA
- [Telehealth HIPAA compliance for non-clinician founders](/blog/hipaa-for-founders): Where PHI flows in a founder-led brand
- [Cuvo compliance](/compliance): HIPAA infrastructure and the business associate agreement
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/protected-health-information