PHI
CIPP/US glossary · Last reviewed: · By Victor Humenhuk (CIPP/US certified)
PHI - Protected health information: individually identifiable health information held by a covered entity or business associate that identifies or could identify the individual and relates to their health, care, or payment.
In the CIPP/US body of knowledge, PHI comes up under Chapter 8: Medical Privacy.
PHI in context
- laws differ on consent: ==opt-in== (COPPA parental consent, HIPAA PHI disclosure, FCRA credit report release); ==opt-out== (GLBA third-party transfers, VPPA, CAN-SPAM, Do Not Call); and ==no option== for commonly accepted practices like order fulfillment. (Opt-In, Opt-Out, and No Option)
- ==PHI== is individually identifiable health information held by a covered entity or business associate relating to a person's health, care, or payment. (PHI and ePHI Defined)
- A ==business associate== performs services for a covered entity involving the use or disclosure of PHI. (Business Associates and BAAs)
Where PHI is covered in the CIPP/US study notes
Related terms
- ePHI
- Tracking Technologies
- FTC Act
- Warby Parker
Test yourself on PHI
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/US practice questions, or read the full CIPP/US study guide - every study note is free.