Since the implementation of the HIPAA Privacy Rule in April 2003, the definition of protected health information (PHI) has not changed. However, the understanding of what PHI is has evolved. Many individuals thought PHI was only information related to a patient seen in some context by a healthcare provider (for the purpose of this column, the focus will be on healthcare providers). The definition of PHI encompasses the definitions of both health information and individually identifiable health information (IIHI) under HIPAA regulations. To understand what PHI is, it is important to review these definitions.