PHI (Protected Health Information)

Protected Health Information (PHI) is a legal term defined under the U.S. Health Insurance Portability and Accountability Act (HIPAA). It refers to individually identifiable health information — data about a person's physical or mental health condition, the healthcare they've received, or payment for that healthcare — that is created, received, or maintained by a covered entity (such as a healthcare provider, health plan, or healthcare clearinghouse) or its business associates.

The defining feature of PHI is the combination of two things: health-related content, and a link to a specific identifiable person. Health information stripped of that identifying link — through a recognized de-identification process — is no longer PHI under HIPAA, which is why identifying a patient's name, dates, medical record numbers, and similar details is central to the distinction between data that's regulated as PHI and data that isn't. This is also why PHI overlaps closely with, but isn't identical to, the broader concept of medical identifiers: PHI is the legal category the identifiers help define.

A hospital using an AI scribe to draft clinical documentation from a patient visit is a clear example of where PHI status determines what's permissible. If the recording or transcript includes the patient's name, date of birth, and diagnosis, it constitutes PHI under HIPAA, meaning it can only be shared with an AI vendor under specific conditions — typically requiring a Business Associate Agreement (BAA) with the vendor, or de-identification of the data before it's transmitted.

The same considerations apply throughout the healthcare industry and its vendors: a health insurer using AI to review claims data that includes beneficiary information and diagnosis codes, a pharmaceutical company analyzing patient-reported outcomes that could be traced back to specific trial participants, or a telehealth platform using AI to summarize patient encounters in real time. In each case, whether the data being sent to an AI tool qualifies as PHI determines whether a BAA is required, whether de-identification is a viable alternative, and what safeguards HIPAA obligates the organization to have in place.

Organizations that send PHI to an AI vendor without a BAA in place, or without properly de-identifying the data first, are exposed to a HIPAA compliance failure that exists independent of whether the vendor actually mishandles the data. HIPAA specifically requires covered entities to have a BAA with any business associate — including an AI vendor — that creates, receives, maintains, or transmits PHI on the covered entity's behalf, and failing to have one in place is itself a violation, regardless of the vendor's actual security practices.

Questa AI applies its entity-detection engine specifically to the identifiers that determine whether health data qualifies as PHI under HIPAA — patient names, dates, medical record numbers, beneficiary IDs, and other identifying details — masking them before health-related content is transmitted to an external AI model. This is closely related to Questa's support for local and self-hosted deployment, since healthcare organizations can keep both the identification process and the underlying patient data within infrastructure they directly control, reducing reliance on a BAA covering data that could instead be de-identified before it ever reaches the vendor.

This approach is particularly relevant for healthcare organizations that need to demonstrate — not just assert — that health data reaching an AI vendor either qualifies for de-identified treatment or is properly covered by appropriate agreements, since Questa's Blackbox recording documents what was detected and masked and when. Combined with the governance dashboard's visibility into where in the pipeline this protection is applied, Questa helps healthcare organizations manage the specific compliance distinction HIPAA draws between PHI and de-identified data.