Related Terms

HIPAA

HIPAA-compliant texting

 

See Also

Texting rules depend on what counts as PHI. See how compliant patient texting works

Two-way HIPAA Texting

ABOUT THIS ENTRY

Category Core: Compliance

Reading time: 1 min

Updated: Nov 2026

PHI (Protected Health Information)

Definition

PHI (protected health information) is any health information held by a covered entity or its business associate that can identify a patient, such as a name tied to a diagnosis, a visit date, or a lab result.

Why the distinction matters

HIPAA's Privacy Rule protects PHI in any form: paper, spoken, or electronic. Two things make data PHI. It relates to a person's health, care, or payment for care, and it can be linked to that person. HHS lists 18 identifiers, including names, phone numbers, and medical record numbers.

For a practice, the day-to-day question is what may go in a text, email, or voicemail. Standard SMS isn't encrypted, so a message that pairs a patient's name with a condition or result exposes PHI. Keeping texts generic, or sending a secure link, avoids that.

Example

 A reminder that reads "Hi John, you have an appointment on January 25 at 2 PM. Reply YES to confirm" shares no health details. A text that reads "John Smith, your cardiology appointment to address your coronary artery disease is January 25" ties a name to a condition, so it contains PHI and needs encrypted messaging.

Frequently Asked

  • Is a patient's name alone PHI?

    A name alone isn't health data. It becomes PHI when it's linked to health information, like an appointment at a specialty clinic or a diagnosis.

  • Is an appointment reminder text PHI?

    It can be. A reminder with just a date and time is low risk. Adding the reason for the visit or the doctor's specialty can make it PHI.

  • Who has to protect PHI?

    Covered entities, like practices and health plans, and their business associates, like software vendors that handle PHI for them.