Which statement best defines protected health information (PHI)?

Which statement best defines protected health information (PHI)?

• A. A subset of information that identifies a patient, such as name and contact info.
• B. Only financial information related to a patient.
• C. Only the patient's medical test results.
• D. Any information that identifies a patient, including a wide range of identifiers such as name, SSN, address, dates, and biometrics.

Answer: (D)

PHI includes information that can identify a person and that relates to their health care or payment for health care. The best statement captures both parts: the identifying nature of the data and the broad range of identifiers that can tie information to a specific individual, such as name, SSN, address, dates, and biometrics. This broad set of identifiers shows how PHI can be spread across many data elements, not just a single type of health data. The other options are narrower. Focusing only on identifying information without tying it to health care or payment misses the health-care context that makes the data PHI. Limiting to financial information or to just one type of health data (like test results) fails to reflect how PHI includes either health information or identifiers—or both—when connected to health care activities.

PHI includes information that can identify a person and that relates to their health care or payment for health care. The best statement captures both parts: the identifying nature of the data and the broad range of identifiers that can tie information to a specific individual, such as name, SSN, address, dates, and biometrics. This broad set of identifiers shows how PHI can be spread across many data elements, not just a single type of health data.

The other options are narrower. Focusing only on identifying information without tying it to health care or payment misses the health-care context that makes the data PHI. Limiting to financial information or to just one type of health data (like test results) fails to reflect how PHI includes either health information or identifiers—or both—when connected to health care activities.