Which data elements in the classifications of institutional data are considered protected health information (PHI)?

The data elements listed on the Data classifications page may or may not constitute PHI, based on the context. The following table clarifies this by providing a list of data elements that do or may constitute PHI; any data element not appearing in the list below is not PHI. For questions or more information, contact Leslie Pfeffer, the Interim University HIPAA Privacy Officer.

Note: While this document refers to PHI, which also includes written and oral information, the only type of PHI that is stored and analyzed on UITS computer systems is electronic PHI (ePHI).

Data element Classification
Is data containing the element PHI?
Health information - Fax numbers
Critical PHI
Health information - Email address
Critical PHI
Health information - Medical record numbers
Critical PHI
Health information - Health plan beneficiary numbers
Critical PHI
Health information - Account numbers
Critical PHI
Health information - Certificate/license numbers
Critical PHI
Health information - Device identifiers
Critical PHI
Health information - URLs, IP addresses
Critical PHI
Health information - Biometric identifiers
Critical PHI
Health information - Full face photographic images
Critical PHI
Health information - Any other unique identifier
Critical PHI
Health information - Telephone numbers
Critical PHI
Health information - Names Critical PHI
Social Security number Critical
PHI if it satisfies this definition
Driver's license number Critical
PHI if it satisfies this definition
Passport number Critical
PHI if it satisfies this definition
Visa number Critical
PHI if it satisfies this definition
State identification card number
Critical
PHI if it satisfies this definition
Certificate/license number Critical
PHI if it satisfies this definition
All payment card data (including all credit/debit cards and cardholder information)
Critical
PHI if it satisfies this definition
Debit card number Critical
PHI if it satisfies this definition
Bank account number or other financial account numbers
Critical
PHI if it satisfies this definition
Health information Critical
PHI if it satisfies this definition; not PHI if it has been de-identified
Health information - Geographic information smaller than a state
Critical PHI
Date of birth/age Restricted
PHI if it satisfies this definition
Emergency contact Restricted
PHI if it satisfies this definition
Home mailing address Restricted
PHI if it satisfies this definition
Home phone Restricted
PHI if it satisfies this definition
Visa status Restricted
PHI if it satisfies this definition
Country of birth or citizenship
Restricted
PHI if it satisfies this definition
Work authorization (I-9) Restricted
PHI if it satisfies this definition
Job action reason (e.g., terminations or leave)
Restricted
PHI if it satisfies this definition
Benefits enrollment info Restricted
PHI if it satisfies this definition
Payroll information (e.g., taxes, deductions, etc.)
Restricted
PHI if it satisfies this definition
Marital status Restricted
PHI if it satisfies this definition
Examples: IU University ID, preferred name/prior name, position information, part-time/full-time indicator
University-internal
PHI if it satisfies this definition
Dates of first and last employment
Public
PHI if it satisfies this definition
Name Public
PHI if it satisfies this definition
Compensation Public
PHI if it satisfies this definition
Job title Public
PHI if it satisfies this definition
Job description Public
PHI if it satisfies this definition
Business address Public
PHI if it satisfies this definition
Business telephone number Public
PHI if it satisfies this definition
Previous work experience Public
PHI if it satisfies this definition
Education and training background
Public
PHI if it satisfies this definition

For more, see:

This is document bdtx in the Knowledge Base.
Last modified on 2016-02-12 00:00:00.

  • Fill out this form to submit your issue to the UITS Support Center.
  • Please note that you must be affiliated with Indiana University to receive support.
  • All fields are required.

Please provide your IU email address. If you currently have a problem receiving email at your IU account, enter an alternate email address.

  • Fill out this form to submit your comment to the IU Knowledge Base.
  • If you are affiliated with Indiana University and need help with a computing problem, please use the I need help with a computing problem section above, or contact your campus Support Center.

Please provide your IU email address. If you currently have a problem receiving email at your IU account, enter an alternate email address.