Which statement best defines PHI?

• A. info created or received by a covered entity
• B. information unrelated to health care
• C. data that cannot identify an individual
• D. public health data in anonymized form

Answer: (A)

PHI refers to information created or received by a HIPAA-covered entity or business associate that relates to a person’s health status, the provision of health care, or the payment for health care, and that identifies the individual or could reasonably identify them. The reason the statement about information created or received by a covered entity is the best fit is that PHI is defined by its association with health care activities and its link to an identifiable person, and it must be held by a covered entity or business associate. The other options describe information that is not PHI: data unrelated to health care, data that cannot identify an individual, and anonymized public health data are not PHI because they either don’t pertain to health care or are de-identified.