Educational Update about HIPAA's Protected Health Information

Educational Update About PHI
Under HIPAA, protected health information (PHI) refers to personally identifiable health information relating to an individual’s past, present, or future physical or mental health condition that is created, gathered, transmitted, or maintained by a HIPAA-associated entity when providing, paying, or facilitating healthcare operations. HIPAA-associated entities include covered entities, such as healthcare providers or healthcare clearinghouses, that transmit health information electronically along with those organizations or individuals who, while carrying out services on their behalf, access PHI (HIPAA Journal, 2017).
PHI concerns physical records containing personally identifiable health information of patients or health plan members. HIPAA requires these entities to implement physical, administrative, and technical barriers to ensure that this information is restricted to only those who have the right to view PHI information. Examples of protected health information under HIPAA include medical diagnoses, insurance information, treatment information, prescription information, medical test results, national identification numbers, as well as demographic information like ethnicity, emergency contact information, gender, and birth dates.
Privacy, as it relates to the use of technology in health care, refers to people’s right to manage access to their personal health information: people have the right to control what data to share, with whom, and how to share it. On the other hand, security refers to the protection measures and tools employed to guarantee that PHI and health information systems cannot be accessed or modified without authorization and that those with authorized access to PHI are not denied the same (Bani Issa et al., 2020). An example of privacy is the use of individual passwords in patient portals to allow every individual the ability to control his or her information. Security in the context of health care technology has two components: data security protocols to protect PHI and system security measures relating to hardware, software, institutional policies, and personnel. An example of security is encryption to protect PHI during transit: encryption makes it safe to transfer sensitive patient data such as medical histories to referrals without risk of interception.
Confidentiality is tied to privacy and security since it relates to the process ...