Which statement about PHI is true?

• A. PHI includes only patient names
• B. PHI includes any health information that can identify a patient
• C. PHI excludes demographic information
• D. PHI includes only lab results

Answer: (B)

PHI stands for Protected Health Information, and what’s being tested is why health information stays protected when it can be tied to a person. The true point is that PHI includes any health information that can identify a patient. That means if data about someone’s health—like a diagnosis, treatment, or billing detail—can be linked to that person through a piece of identifying data (such as their name, date of birth, address, or medical record number), it’s PHI. The protection isn’t limited to names alone; it covers a wide range of identifiers and combinations of data that could reveal who the patient is.

That’s why PHI isn’t limited to just lab results or just names, and why demographic details aren’t excluded on their own. If you have health information and you can connect it to an individual, it’s PHI.