Compliance

Protected Health Information (PHI)

Identifiable health information covered by HIPAA.

How the laws define this

Both cited instruments establish that Protected Health Information encompasses any information concerning health status, healthcare provision, or healthcare payment linked to an individual under HIPAA. The primary divergence lies in how precisely the individual is identified and whether an explicit protection requirement is stated. The rule for Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly covers data linkable to "an individual" and explicitly commands that PHI must be protected to ensure patient privacy and security under HIPAA. Conversely, the regulation for Hospitals, nursing homes, etc.; regulations, patient access to intelligent personal assistant specifies data linkable to a "specific individual," anchoring its meaning "as defined under HIPAA" without detailing a distinct mandate regarding privacy and security protections.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
United States	Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly	In Force	This definition explicitly states that PHI must be protected under HIPAA to ensure patient privacy and security, adding a privacy and security obligation not emphasized in the other.
Virginia, United States	HB 2154 Hospitals, nursing homes, etc.; regulations, patient access to intelligent personal assistant.	In Force	This definition is plain, adding nothing beyond restating the core HIPAA concept without additional context or obligations.

What it triggers

Under the Medicare Advantage Program, PHI must be protected to ensure patient privacy and security.source
In Virginia, licensed hospitals and nursing homes must permit inpatient access to personal intelligent assistants.source

Definitions (2)

Protected Health Information (PHI) refers to any information about health status, provision of healthcare, or payment for healthcare that can be linked to an individual. Under HIPAA, PHI must be protected to ensure patient privacy and security.

Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the ElderlyDefinition 1 of 2

Any information about health status, provision of healthcare, or payment for healthcare that can be linked to a specific individual, as defined under HIPAA.

Hospitals, nursing homes, etc.; regulations, patient access to intelligent personal assistant.Definition 2 of 2

Not to be confused with

Individually identifiable health information

Individually identifiable health information is health information that can be linked to a specific person, while PHI specifically covers information about health status, provision of healthcare, or payment for healthcare.

Covered Entity

Covered entity refers to a healthcare organization subject to HIPAA requirements, whereas PHI is the identifiable health information those entities must protect.

Questions and answers

What obligations apply to PHI in Medicare Advantage plans?

PHI must be protected to ensure patient privacy and security. CMS's 2023 rule allows AI use for coverage decisions with mandates for individualized assessments, transparency, and bias mitigation.

How does Virginia law address PHI in hospitals and nursing homes?

PHI is defined under HIPAA as information about health status, provision of healthcare, or payment linked to an individual. HB 2154 requires regulations for inpatient access to personal intelligent assistants.

What makes PHI protection distinctive in the Medicare program?

The definition emphasizes protection for patient privacy and security. It ties to rules allowing AI in coverage decisions with specific safeguards.