Which of the following is an example of PHI when linked to an individual patient?

• A. A hospital policy document
• B. An anonymized research data set
• C. A patient's name and birth date
• D. A hospital building security code

Answer: (C)

PHI includes information about a patient’s health status, health care, or payment for health care that can identify the individual. The crucial point is linkage to an identifiable person. The combination of a patient’s name and birth date identifies who the person is and can be connected to their health information, so it qualifies as PHI. The hospital policy document is general and not by itself linked to a specific patient’s health data. An anonymized data set has had identifiers removed and cannot be tied to a particular person. A hospital building security code has nothing to do with health information. Therefore, the patient’s name and birth date is the example that becomes PHI when linked to an individual.