---
title: "Protected Health Information (PHI)"
description: "PHI is identifiable health data regulated by HIPAA. What counts as PHI, why pasting it into AI tools is a disclosure event, and how to prevent it."
url: "https://sonomos.ai/glossary/protected-health-information/"
source: "https://sonomos.ai/glossary/protected-health-information/"
---

# Protected Health Information (PHI)

Individually identifiable health information held or transmitted by a covered entity, regulated under HIPAA in the United States.

## In depth

Protected Health Information (PHI) is the HIPAA term for any health data — diagnosis, treatment, payment, demographics — that can be tied back to an individual when held by a covered entity (provider, plan, clearinghouse) or its business associates. PHI is broader than just clinical records: dates, account numbers, photos, device identifiers, and even ZIP codes can become PHI when linked to a health context. Pasting PHI into a third-party AI tool without a Business Associate Agreement is a HIPAA disclosure event in most analyses.

## Examples

- Patient names appearing alongside diagnoses or visit dates.
- Medical record numbers, prescription IDs, DEA numbers.
- Insurance subscriber IDs, claim numbers, billing codes.
- Imaging file names that include patient identifiers.

## How Locke handles protected health information (phi)

Locke detects patterns consistent with PHI — MRNs, ICD-10/CPT codes, NPIs, prescription identifiers, demographic combinations — locally, before any text reaches an AI model. Because Sonomos never sees the data itself, no new business associate relationship is created. See the Healthcare page for the regulatory walk-through.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Personally Identifiable Information (PII)

  Any information that can identify a specific person, either directly (name, SSN) or in combination with other data (zip code + birthdate).
- Redaction

  Removing or blacking-out sensitive content so it is no longer present in the document or prompt.
- Privacy Layer for AI

  A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.

## Reading on this topic

- [PHI vs PII vs Personal Data: A Plain-English Compliance Glossary for 2026](https://sonomos.ai/blog/phi-vs-pii-vs-personal-data-glossary/)
- [HIPAA-Compliant AI: A Complete Checklist for Healthcare Organizations in 2026](https://sonomos.ai/blog/hipaa-compliant-ai-checklist-2026/)
- [Is Perplexity AI HIPAA Compliant? A 2026 Guide for Healthcare Teams](https://sonomos.ai/blog/is-perplexity-ai-hipaa-compliant-2026/)
- [Is Microsoft Copilot HIPAA Compliant? M365, GCC, and the Real Answer for 2026](https://sonomos.ai/blog/is-microsoft-copilot-hipaa-compliant-2026/)