PII and PHI often appear together in conversations about privacy, healthcare, and data security.
They are not interchangeable.
PII identifies a person. PHI connects an identifiable person with health, healthcare, or payment information in a context covered by HIPAA.
That distinction sounds simple until the same name, email address, diagnosis, insurance record, device identifier, or AI prompt moves between healthcare providers, employers, consumer applications, cloud platforms, research environments, and AI systems.
Context matters.
A person’s name in an employee directory may qualify as PII.
That same name attached to a diagnosis inside a hospital’s patient record can form part of PHI.
Health information stored by a HIPAA covered entity or business associate may qualify as PHI. Similar information entered independently into a consumer application may fall outside HIPAA while still facing protection under other privacy, consumer-protection, or state health-data laws.
The data matters. Who holds it, why they hold it, and how they use it matter too.
AI adds another layer. Healthcare organizations now need to understand whether PHI and other personal data can enter prompts, training datasets, RAG systems, vector databases, copilots, research workflows, and autonomous agents.
This guide explains the difference between PII and PHI, where they overlap, how HIPAA treats PHI, and how organizations can protect both as healthcare data spreads across cloud, SaaS, analytics, and AI.
PII vs. PHI: Key Takeaways
• PII and PHI overlap, but they are not the same. PII identifies or links to an individual. PHI combines identifiable information with health, healthcare, or payment information in a HIPAA-regulated context.
• Context determines whether health information qualifies as PHI under HIPAA. HIPAA applies to PHI that covered entities and business associates create, receive, maintain, or transmit.
• PHI can exist in any medium. HIPAA’s Privacy Rule covers PHI in electronic, paper, and oral form. The Security Rule specifically addresses electronic PHI, or ePHI.
• Healthcare data now extends far beyond the EHR. PHI and other sensitive data can appear across SaaS, cloud storage, research repositories, collaboration tools, analytics, backups, AI systems, and third-party environments.
• AI creates new exposure paths. Models, RAG systems, prompts, copilots, agents, vector databases, and machine identities can retrieve or process sensitive healthcare information.
• Protection starts with knowing the data. Organizations need to discover PII and PHI, classify it correctly, understand access, reduce exposure, monitor activity, enforce retention, and govern AI use.
What Is the Difference Between PII and PHI?
The primary difference comes down to what the information describes and the context in which an organization handles it.
Personally Identifiable Information (PII) generally refers to information that can distinguish, trace, identify, or link to an individual.
Protected Health Information (PHI) under HIPAA generally refers to individually identifiable health information that a covered entity or business associate creates, receives, maintains, or transmits.
PHI can relate to:
- A person’s past, present, or future physical or mental health
- Healthcare provided to that person
- Past, present, or future payment for healthcare
The information must also identify the individual or provide a reasonable basis for identifying them.
| Question | PII | PHI |
|---|---|---|
| What does it describe? | Information that identifies or links to an individual | Identifiable health, healthcare, or payment information |
| Is it healthcare-specific? | No | Yes, under HIPAA |
| Who can hold it? | Organizations across industries | HIPAA covered entities and business associates in the PHI context |
| Examples | Name, email, SSN, address, account identifiers | Diagnosis, medical record, lab result, prescription, claims information linked to an individual |
| Primary U.S. healthcare law | Depends on context and applicable law | HIPAA |
A useful shortcut: PHI contains identifiable health context. PII does not need to contain health information.
What Is PII?
Personally Identifiable Information describes information that can identify, distinguish, trace, or link to an individual, either on its own or when combined with other information.
Common examples include:
- Name
- Home address
- Email address
- Phone number
- Social Security number
- Passport number
- Driver’s license number
- Financial account information
- Biometric identifiers
- Employee or customer identifiers
- Device and online identifiers in relevant contexts
PII can exist across virtually every industry.
For a deeper explanation of direct identifiers, indirect identifiers, sensitive PII, personal data, and AI risk, see What Is PII Data?
What Is PHI?
Protected Health Information is individually identifiable health information that a HIPAA covered entity or business associate holds or transmits.
The HHS HIPAA Privacy Rule guidance explains that PHI can exist in electronic, paper, or oral form.
Examples can include:
- Medical records
- Diagnoses
- Lab results
- Prescriptions
- Imaging records
- Treatment information
- Health-plan information
- Insurance claims
- Billing records
- Payment information associated with healthcare
- Genetic information in a covered context
- Patient identifiers associated with healthcare information
A diagnosis alone does not tell the whole regulatory story.
The organization and processing context matter.
Find PHI Wherever It Lives
Healthcare data extends far beyond the EHR
Discover and classify PHI, PII, clinical records, research data, financial information, credentials, and other sensitive healthcare data across cloud, SaaS, databases, files, research environments, and AI-connected systems.
Is PHI a Type of PII?
The categories overlap, but treating PHI simply as another name for PII misses an important legal distinction.
PHI contains information that identifies or can identify an individual, plus health, healthcare, or payment information in a HIPAA-regulated context.
Consider these examples:
Name + company email address
This may constitute PII, but it does not become PHI simply because it identifies someone.
Name + hospital diagnosis
When a HIPAA covered entity or business associate holds that information in the relevant context, it can qualify as PHI.
Heart-rate information inside a consumer fitness application
The information concerns health, but HIPAA does not automatically cover it. The answer depends on who creates, receives, maintains, or transmits the information and why.
That third example has become increasingly important as consumer health applications, wearables, connected devices, digital health platforms, and AI services collect health-related information outside traditional healthcare systems.
Health data and PHI are not automatically the same thing.
When Does PII Become PHI?
A direct identifier can become part of PHI when it connects to identifiable health information in a HIPAA-regulated context.
Context Changes the Classification
The identifier alone does not tell the whole story
Identifier
Can the information identify the person?
Health Context
Does it relate to health, care, or payment?
HIPAA Context
Does a covered entity or business associate hold or transmit it?
PHI
HIPAA protections and obligations apply.
This context-first approach helps teams avoid a common mistake: classifying data solely by pattern without considering its relationship to the person, healthcare activity, and regulated environment.
What Is ePHI?
Electronic Protected Health Information, or ePHI, is PHI that organizations create, receive, maintain, or transmit electronically.
Examples include:
- Electronic health records
- Digital lab results
- Electronic claims
- Patient portal information
- PHI stored in cloud databases
- PHI in SaaS applications
- Electronic clinical notes
- Digital imaging records
- Electronic backups containing PHI
The distinction matters because HIPAA’s Security Rule specifically addresses ePHI through administrative, physical, and technical safeguards.
What Data Is Not PHI Under HIPAA?
Not every piece of health-related information qualifies as PHI.
Examples can include:
- Health information that a consumer enters independently into certain personal applications outside a covered-entity or business-associate relationship
- Employment records that a covered entity maintains in its role as an employer
- Certain education records covered by FERPA
- Health information that no longer qualifies as individually identifiable after appropriate de-identification under HIPAA
This distinction has become especially important as health information moves through wellness applications, consumer devices, online services, AI products, and other systems outside traditional healthcare.
Other federal or state laws may still protect that information even when HIPAA does not.
How Does HIPAA De-Identification Affect PHI?
HIPAA provides methods for de-identifying PHI so the information no longer identifies an individual and the risk of identification meets the applicable standard.
HHS recognizes two approaches:
- Expert Determination: A qualified expert applies accepted statistical and scientific principles to determine that the risk of identifying an individual remains very small.
- Safe Harbor: The organization removes the identifiers specified by the HIPAA Privacy Rule and has no actual knowledge that the remaining information could identify the individual.
De-identification deserves careful treatment.
Removing a person’s name does not automatically make a dataset anonymous.
Other attributes can still make an individual identifiable, especially when teams combine datasets.
For AI and analytics, organizations should evaluate re-identification risk before assuming that transformed healthcare data no longer creates privacy risk.
What Rules Protect PII and PHI?
PII and PHI do not sit under one universal privacy law.
Different laws use different definitions, scopes, rights, and obligations.
HIPAA
HIPAA establishes federal requirements around PHI for covered entities and business associates.
Its major rules include:
- Privacy Rule: Governs uses and disclosures of PHI and gives individuals rights concerning their health information.
- Security Rule: Establishes safeguards for ePHI.
- Breach Notification Rule: Establishes notification requirements for breaches of unsecured PHI.
One important correction to older explanations of HIPAA: HIPAA does not require patient consent before every collection, use, or disclosure of PHI. The Privacy Rule permits certain uses and disclosures, including for treatment, payment, and healthcare operations, without individual authorization. Other uses can require authorization.
GDPR
The GDPR uses the term personal data, not PII.
It also treats data concerning health as a special category of personal data and places additional conditions on processing it.
Organizations should not translate HIPAA’s PHI concept directly into GDPR terminology. The two frameworks use different scopes and legal structures.
U.S. State Privacy and Consumer Health Laws
State privacy requirements can apply to personal and health-related information outside HIPAA.
This matters for digital health platforms, wellness services, consumer applications, advertising ecosystems, connected devices, and AI products that process health-related information without operating as HIPAA covered entities or business associates.
HIPAA coverage should never serve as the only test for whether health data needs protection.
Why PII and PHI Protection Has Become Harder
Healthcare data no longer stays inside the hospital record system.
PHI, PII, clinical information, research data, billing information, credentials, and genomic data can spread across:
- EHR and EMR systems
- Cloud storage
- SaaS applications
- Databases
- File shares
- Collaboration platforms
- Analytics environments
- Research repositories
- Data lakes and warehouses
- Backups
- Third-party applications
- AI training datasets
- RAG systems
- Vector databases
- AI prompts and responses
- Copilots and AI agents
Every new copy can introduce another access path.
Every new integration can introduce another identity.
Every new AI workflow can create another way for sensitive healthcare data to move.
How AI Changes PII and PHI Risk
The old AI conversation focused heavily on using machine learning to detect security threats.
The bigger issue now is that AI itself has become a consumer of sensitive healthcare data.
Healthcare Data in the AI Era
Sensitive data can move from patient record to AI-driven action
Discover
Where does PII and PHI exist?
Access
Who or what can reach it?
Retrieve
Can AI retrieve it through RAG or search?
Process
Does it enter models, prompts, or agents?
Act
Can AI share it or take downstream action?
RAG Can Surface PHI
A healthcare RAG system may retrieve information from clinical notes, research documents, patient records, or other repositories.
Retrieval relevance alone does not establish authorization.
Organizations also need to know whether the requesting user, application, or AI identity should receive the sensitive information.
AI Agents Can Inherit Broad Access
An agent may access healthcare data through a user account, application, service account, API, machine identity, or delegated permission.
Broad permissions can give the agent access to more PII or PHI than the task requires.
Prompts and Responses Can Contain Sensitive Data
Clinicians, researchers, employees, applications, and patients can place personal or health information into prompts.
AI systems can also return sensitive information in responses.
Teams therefore need controls around both inputs and outputs.
AI Can Combine Data From Multiple Sources
AI can bring together records that teams previously viewed separately.
That creates additional privacy and re-identification concerns, particularly when one source contains direct identifiers and another contains health, behavioral, demographic, or genomic information.
AI does not change what PHI means under HIPAA. It changes the number and complexity of paths through which sensitive healthcare data can move.
How Should Organizations Protect PII and PHI?
Protecting healthcare data starts with the data itself.
1. Discover PII and PHI Everywhere
Continuously identify sensitive healthcare data across structured and unstructured environments.
Do not limit discovery to the EHR.
Include cloud, SaaS, databases, files, research environments, analytics, collaboration systems, backups, and AI-connected data.
2. Classify the Data With Context
A Social Security number, diagnosis, patient identifier, genomic record, credential, and billing record should not all receive the same treatment.
Classification should identify what the data contains, its sensitivity, regulatory context, location, ownership, and purpose.
3. Understand Access
Map sensitive data to:
- Clinicians
- Employees
- Contractors
- Third parties
- Applications
- Service accounts
- Machine identities
- AI systems and agents
The security question is not only whether an identity authenticated.
It is whether that identity needs access to this sensitive data for this purpose.
4. Reduce Excessive Access
Find broad, stale, inherited, external, unnecessary, or high-risk permissions connected to PHI and PII.
Apply least privilege according to legitimate business and clinical needs.
5. Monitor Sensitive Data Activity
Understand how people and systems access, download, share, modify, move, and delete healthcare information.
Activity context can help teams distinguish legitimate access from suspicious or unusual behavior.
6. Minimize and Retain Data Intentionally
Unnecessary sensitive data creates unnecessary exposure.
Identify stale, redundant, obsolete, duplicate, expired, and over-retained healthcare information, then apply applicable retention, legal hold, minimization, and deletion policies.
7. Protect AI Workflows
Identify which AI models, copilots, agents, RAG applications, vector stores, prompts, and datasets can access PII or PHI.
Connect that access to identity, purpose, policy, and risk.
8. Prepare for Breach Investigation
When an incident occurs, security and privacy teams need to answer:
- What sensitive information did the incident affect?
- Where did it live?
- Which individuals did it relate to?
- Who or what could access it?
- What activity occurred?
- Which regulatory obligations apply?
- What action reduces further exposure?
Data context can turn a generic infrastructure incident into a much clearer assessment of actual healthcare-data impact.
Turn HIPAA Policy Into Data Control
Know where PHI lives, who can access it, and where risk requires action
Connect PHI discovery with access governance, exposure analysis, activity, retention, remediation, breach response, and audit evidence.
How BigID Helps Protect PII and PHI
BigID helps healthcare organizations connect sensitive-data discovery with security, privacy, access, compliance, AI governance, and remediation.
The starting point is simple:
You cannot protect PHI you cannot find, and you cannot prioritize its risk without understanding its context.
BigID helps organizations:
- Discover sensitive healthcare data: Find PII, PHI, clinical information, genetic data, financial records, credentials, research data, and other sensitive information across structured and unstructured environments.
- Classify data with context: Identify personal, health, regulated, confidential, proprietary, and AI-connected data across cloud, SaaS, hybrid, and on-premises environments.
- Operationalize HIPAA compliance: Connect PHI discovery with access, activity, exposure, retention, remediation, breach investigation, reporting, and audit evidence.
- Understand access: Connect sensitive healthcare data with users, groups, applications, service accounts, machine identities, third parties, and AI systems.
- Add activity context: Understand how sensitive healthcare information gets accessed, downloaded, moved, shared, modified, and deleted.
- Reduce unnecessary data: Identify stale, redundant, obsolete, trivial, duplicate, and over-retained information that increases healthcare-data exposure.
- Secure healthcare AI: Understand sensitive data used by AI and connect models, agents, copilots, RAG, datasets, identities, access, lineage, policy, and risk.
- Drive remediation: Reduce access, delete unnecessary information, apply retention, redact sensitive values, assign ownership, and coordinate corrective action where supported.
BigID’s healthcare approach follows a clear progression:
Discover → Understand → Protect → Govern → Act
The goal goes beyond finding PHI.
Healthcare organizations need to know where sensitive data lives, who and what can reach it, how teams and systems use it, where exposure creates risk, and what action reduces that risk.
Connect the Dots Across Data & AI
Protect Patient Data From Discovery to Action
See how BigID helps healthcare organizations discover PHI, understand access, reduce exposure, support HIPAA compliance, and secure sensitive data across cloud, SaaS, research, analytics, and AI.
PII vs. PHI FAQs
What is the main difference between PII and PHI?
PII identifies or links to an individual. PHI under HIPAA combines identifiable information with information about health, healthcare, or payment for healthcare in a covered-entity or business-associate context.
Is PHI considered PII?
PHI and PII overlap because PHI contains information that identifies or can identify an individual. PHI has the additional HIPAA-specific health and regulated-entity context, so organizations should not use the terms interchangeably.
Can PII become PHI?
Yes. An identifier such as a name, address, or Social Security number can become part of PHI when it connects to identifiable health, healthcare, or payment information in a HIPAA-regulated context.
Is all health information PHI?
No. Health information does not automatically qualify as PHI. HIPAA’s PHI definition depends on both identifiable health information and the covered entity or business associate context.
What are examples of PHI?
Examples can include identifiable medical records, diagnoses, prescriptions, lab results, imaging records, insurance claims, billing information, treatment records, and other health information that a HIPAA covered entity or business associate holds or transmits.
What is ePHI?
ePHI means electronic protected health information. It includes PHI that covered entities or business associates create, receive, maintain, or transmit electronically.
Does HIPAA protect PII?
HIPAA protects individually identifiable health information that qualifies as PHI. It does not function as a general federal law for every form of PII.
Does HIPAA apply to health apps?
Not automatically. HIPAA applicability depends on whether the organization operates as a covered entity or business associate and on the relevant data relationship. Other federal or state requirements can still apply to consumer health information outside HIPAA.
Does removing a patient’s name make data non-PHI?
Not necessarily. Other identifiers can still make health information identifiable. HIPAA provides specific de-identification methods, including Safe Harbor and Expert Determination.
How does AI affect PHI security?
AI can create additional paths to PHI through training datasets, RAG retrieval, prompts, responses, vector databases, copilots, applications, APIs, and autonomous agents. Organizations need to understand both the sensitive data and the identities, permissions, systems, and workflows that can access it.
How does BigID help protect PII and PHI?
BigID helps organizations discover and classify PII and PHI, understand access and activity, identify exposure, reduce excessive permissions, enforce retention and minimization, support HIPAA compliance and breach response, govern healthcare AI, and drive remediation.
Author
