PHI includes identifiable health information created or held by which entities?

PHI includes identifiable health information created or held by which entities?

• A. Identifiable health information created or held by covered entities and their business associates.
• B. De-identified health information
• C. Health information unrelated to health care
• D. Health data stored only on paper

Answer: (A)

PHI is identifiable health information that is created or received by covered entities and their business associates. It includes any health data in any form—electronic, paper, or oral—that can identify an individual and relates to the individual’s health status, provision of health care, or payment for health care. This is why the best answer is the one that specifies identifiable information created or held by covered entities and their business associates—the entities responsible for protecting PHI under HIPAA. De-identified health information isn’t PHI because the identifiers have been removed, so it can’t be linked to a specific person. Health information that isn’t related to health care isn’t PHI. And PHI isn’t limited to paper only—it can be stored electronically or in other formats as long as it remains identifiable and is held by those covered entities or their business associates.

PHI is identifiable health information that is created or received by covered entities and their business associates. It includes any health data in any form—electronic, paper, or oral—that can identify an individual and relates to the individual’s health status, provision of health care, or payment for health care. This is why the best answer is the one that specifies identifiable information created or held by covered entities and their business associates—the entities responsible for protecting PHI under HIPAA.

De-identified health information isn’t PHI because the identifiers have been removed, so it can’t be linked to a specific person. Health information that isn’t related to health care isn’t PHI. And PHI isn’t limited to paper only—it can be stored electronically or in other formats as long as it remains identifiable and is held by those covered entities or their business associates.