Health Insurance Portability and Accountability Act

Protected Health Information (PHI) is any information about health status, provision of health care, or payment for health care that can be linked to an individual.

The Privacy Rule only considers information to be Protected Health Information (PHI) if it is created or received by a Covered Entity and is:

• Transmitted by electronic media;
• Maintained in electronic media; or
• Transmitted or maintained in any other form or medium.

Identifiers of the individual or of relatives, employers, or household members of the individual, if they appear with the individual’s PHI, must be removed in order to make the PHI not individually identifiable.

The difference between a Covered Entity and a Business Associate is that a Covered Entity is any organization, agency or person that handles Protected Health Information (PHI) or Personal Health Information (PHI) as part of their operations. A Business Associate is any organization, agency or person that handles Protected Health Information (PHI) or Personal Health Information (PHI) as part of their operations and provides services to a Covered Entity.

The Privacy Rule is a rule that defines the requirements for Covered Entities to protect the privacy of individual’s health information, outlines the permitted uses and disclosures of Protected Health Information (PHI) and establishes the individual’s rights regarding their own health information.