# What Is PHI? Protected Health Information Explained Canonical: https://www.flobotics.io/blog/protected-health-information-phi Author: Krzysztof Szwed Published: 2026-06-05 Updated: 2026-09-01 --- [Home](https://www.flobotics.io/)/[Articles](https://www.flobotics.io/blog)/What Is PHI? Protected Health Information Explained [Healthcare](https://www.flobotics.io/blog?category=healthcare)[RCM](https://www.flobotics.io/blog?category=rcm) # What Is PHI? Protected Health Information Explained [Krzysztof SzwedHead of Delivery at Flobotics](https://www.flobotics.io/our-editorial-team#szwed) Published June 05, 2026Updated September 1, 2026 On this page - [What Is Protected Health Information (PHI)?](#what-is-protected-health-information-phi) - [PHI in Revenue Cycle Management](#phi-in-revenue-cycle-management) - [Electronic PHI (ePHI) and Security Requirements](#electronic-phi-ephi-and-security-requirements) - [Common PHI Breach Risks in RCM](#common-phi-breach-risks-in-rcm) - [PHI Handling in Automation Workflows](#phi-handling-in-automation-workflows) Book a callWant to talk about it? 30 minutes with someone who builds automations, not a sales script. [Talk to us →](https://www.flobotics.io/contact) Share [](#)[](#) ## What Is Protected Health Information (PHI)? Protected Health Information (PHI) is defined under [HIPAA](https://www.flobotics.io/blog/health-insurance-portability-and-accountability-act-hipaa-explanation) as any individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate in connection with healthcare provision or payment. PHI includes 18 specific identifier categories — any one of which, combined with health information, creates a HIPAA-protected record. The 18 categories include: names, geographic data smaller than a state, dates directly related to an individual, phone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying numbers or codes. ## PHI in Revenue Cycle Management The entire RCM workflow is a PHI handling operation. Every claim contains the patient's name, date of birth, insurance ID, diagnosis codes, procedure codes, and service dates — a complete PHI set. Eligibility verification queries contain demographic and coverage PHI. Prior authorization requests contain clinical PHI. EOBs and ERAs contain payment PHI linked to individual patient accounts. This means every vendor, system, and workflow touching any part of the revenue cycle handles PHI and must operate within HIPAA's requirements. Business Associate Agreements (BAAs) must be executed with every third-party vendor — clearinghouses, billing software, automation platforms, cloud infrastructure — that processes PHI on behalf of the covered entity. ## Electronic PHI (ePHI) and Security Requirements ePHI is PHI created, stored, transmitted, or received electronically. The HIPAA Security Rule requires three categories of safeguards: - Administrative safeguards: Policies governing workforce access, training, and incident response - Physical safeguards: Controls over physical access to systems and facilities where ePHI is stored - Technical safeguards: Access controls, audit logs, encryption in transit and at rest, and automatic logoff on ePHI-handling systems Encryption of data in transit (TLS 1.2+ minimum) and at rest (AES-256 standard) is the baseline requirement for any compliant ePHI system — including every platform in your RCM technology stack. ## Common PHI Breach Risks in RCM The most common PHI breach scenarios in RCM include: misdirected faxes containing patient information, unencrypted email transmission of claim data, improper disposal of paper EOBs, unauthorized access to billing systems, and vendor breaches where a business associate's infrastructure is compromised. Each represents both a HIPAA compliance failure and a direct patient harm risk. ## PHI Handling in Automation Workflows HIPAA-compliant RCM automation requires all PHI processed by automated workflows to be transmitted over encrypted connections, stored in HIPAA-compliant infrastructure, access-controlled to minimum necessary data, and fully audit-logged. Our [RCM automation solutions](https://www.flobotics.io/rcm-automation) are built with these requirements as design constraints, not afterthoughts. [Contact us](https://www.flobotics.io/contact) to review your PHI handling architecture. Let’s talk! It’s a 30-minute call. Within the first 15, we’ll know if automation works for you. [Book a call →](https://tidycal.com/team/flobotics/flobotics-intro-call-w) Written byKrzysztof Szwed Head of Delivery at Flobotics. [More from Krzysztof](https://www.flobotics.io/our-editorial-team#szwed) Talk to us ## Show us the process your team is tired of doing manually. Let Karl, our CTO, take a look. It’s 30 minutes with the person who designs the automations, not a sales script. [Book a call with Karl →](https://tidycal.com/team/flobotics/flobotics-intro-call-w)[Send us a message](https://www.flobotics.io/contact) 30-minute callKarl MielnickiCo-founder, CTO Walk me through the process your team does by hand. I’ll tell you whether it’s worth automating and how I’d approach it. Karl Keep reading ## More insight The latest industry news, interviews, technologies, and resources. [ HealthcareRCM ### What Is HIPAA? Rules, Penalties and Impact on RCM What is HIPAA? The federal law governing PHI privacy and security in US healthcare - RCM teams face penalties up to $1.9M per violation category. Karl MielnickiJune 08, 2026 ](https://www.flobotics.io/blog/health-insurance-portability-and-accountability-act-hipaa-explanation)[ HealthcareRCM ### Clinical Documentation Integrity (CDI): Why It Matters Clinical Documentation Integrity (CDI), explained: how documentation gaps drive undercoding and silent revenue leakage. Karl MielnickiMarch 03, 2026 ](https://www.flobotics.io/blog/clinical-documentation-integrity-cdi-explanation)[ HealthcareRCM ### Medical Necessity: How Payers Decide What They Cover Medical necessity, explained: how payers decide if a service qualifies for coverage, and what proof stops denials before they start. Bart TeodorczukMarch 30, 2026 ](https://www.flobotics.io/blog/medical-necessity-explanation) [All articles →](https://www.flobotics.io/blog)