HIPAA protects most individually identifiable health information held or transmitted by a Covered Entity (CE) or its Business Associate (BA), in any form or media, whether electronic, paper, or oral.

HIPAA calls this information “protected health information” or “PHI.” Individually identifiable health information is information, including demographic information, that relates to:

• The individual’s past, present, or future physical or mental health or condition,
• The provision of health care to the individual, or
• The past, present, or future payment for the provision of health care to the individual.

Individually identifiable health information identifies the individual or there is a reasonable basis to believe it can be used to identify the individual.  For example, a medical record, laboratory report, or hospital bill would be PHI if information contained therein includes a patient’s name and/or other identifying information.

See Protected Health Information for more details.

Reference

U.S. Department of Health & Human Services

Health Information Privacy

HIPAA for Professionals