Which statement best describes PHI?

• A. It refers only to doctors.
• B. It includes identifiers and health data that could identify an individual.
• C. It is not protected by HIPAA.
• D. It applies only to hospitals.

Answer: (B)

Protected Health Information, or PHI, is health information that is linked to identifiers that can identify a person, and it is protected by HIPAA. This means PHI includes data like a patient’s name, address, date of birth, phone number, social security number, medical record number, and other details that could identify someone, along with information about their health or care.

The statement that best describes PHI is that it includes identifiers and health data that could identify an individual. That combination—identifying information plus health information—is what makes the data PHI and subject to HIPAA safeguards, regardless of the setting, not just in hospitals or only for doctors.

Why the other ideas don’t fit: PHI isn’t limited to physicians, nor restricted to hospitals, and it is indeed protected by HIPAA, so those descriptions miss the full scope of PHI.