Add patient names or account numbers and that same spreadsheet shows who received care and who owes money for it. No diagnosis column required.
That’s why PHI catches out even experienced billing offices. Patient information moves through claims, remits, appeals, statements, and reports all day, and most of it doesn’t look like a medical record. You can’t protect what you don’t recognize.
What is PHI in medical billing?
We’re sticking to one job here, which is spotting PHI during billing work. For what your practice and vendors have to do about it, see our guide to HIPAA compliance in medical billing.
Context matters more than the field
Where billing teams run into PHI
Appeal packets usually hold the most because the identifiers travel with the notes behind the disputed service. Statements show information related to the dues and balances while an A/R worklist shows the list of real people with unpaid medical bills. Plus, any medical billing call includes a recording and relevant information related to it.
Those are examples. What’s actually in the record decides the answer.
Screenshots Deserve Their Own Warning
Screenshots deserve their own warning. Say someone grabs one to show a clearinghouse rejection. They are thinking about the error but at the sme time the image can pick up another patient account in a single panel.
PHI and ePHI: same information, different format
The 18 identifiers, and where billing teams see them
| # | Identifier | Where you might see it in Billing |
|---|---|---|
| 1 | Names | Claims, statements, work queues, call notes |
| 2 | Geography smaller than a state, such as street, city, county, or ZIP (the first three ZIP digits can stay in some cases) | Registration records, mailing files |
| 3 | All date elements tied to a person except the year, plus ages over 89 | Dates of birth and service on claims, remits, and A/R reports |
| 4 | Telephone numbers | Registration records, call logs |
| 5 | Fax numbers | Referrals, records requests |
| 6 | Email addresses | Portal accounts, e-statements |
| 7 | Social Security numbers | Intake forms, older account records |
| 8 | Medical record numbers | Claim attachments, work queues |
| 9 | Health plan beneficiary numbers | Insurance cards, eligibility responses, claims |
| 10 | Account numbers | Statements, A/R reports, payment records |
| 11 | Certificate or license numbers | Driver’s license copies at intake |
| 12 | Vehicle identifiers and serial numbers, including license plates | Auto accident claims |
| 13 | Device identifiers and serial numbers | DME and implant billing |
| 14 | Web URLs | Links to a patient’s portal record |
| 15 | IP addresses | Portal and online payment logs |
| 16 | Biometric identifiers, including finger and voice prints | Voice or fingerprint verification tools |
| 17 | Full-face photos and comparable images | Photo ID copies at registration |
| 18 | Any other unique identifying number, characteristic, or code | Barcodes, internal tracking codes, a distinctive job title in a note |
What is not --PHI
Information outside the definition can still be protected by other laws, contracts, or your own policies, so “not PHI” doesn’t mean “share freely.”
Removing a name doesn't de-identify a file
Can medical billers access and share PHI?
Protecting PHI during everyday billing work
A good platform protects a report while it sits there. Then someone exports it. Most slips happen in that gap, so these habits focus on what happens between systems. Adapt them to your own risk assessment and policies.
Know where downloaded reports go
Check the recipient and the attachment together
The right file to the wrong recipient is a problem. So is the wrong file to the right payer. Before records go out, match the patient, purpose, recipient, and file, and slow down around autofilled email addresses, similar patient names, and nearly identical filenames. AI tools belong in this conversation too. Pasting a denial letter with patient details into a chatbot is still sharing PHI, so that shouldn’t happen until your practice has evaluated the tool and any required BAA is in place.
Tie access changes to staffing changes
The right file to the wrong recipient is a problem. So is the wrong file to the right payer. Before records go out, match the patient, purpose, recipient, and file, and slow down around autofilled email addresses, similar patient names, and nearly identical filenames. AI tools belong in this conversation too. Pasting a denial letter with patient details into a chatbot is still sharing PHI, so that shouldn’t happen until your practice has evaluated the tool and any required BAA is in place.
Treat calls and paper with the same care
Phone calls are trickier than they look, because what you need from a caller depends on who’s calling. A patient, a family member helping with a bill, and an outside party asking for records don’t all get handled the same way. Write down a process for each. Our HIPAA guide covers family callers in more detail. Paper has its own weak spots. Where do statements wait before mailing? Who can see printed work queues? What happens to discarded copies?
HIPAA Risk & Penalty Exposure Calculator
Evaluate your practice or billing team's vulnerability level based on daily volume, communication habits, offboarding procedures, and vendor Business Associate Agreements.
Tier 3: Willful Neglect - Corrected ($10,000 - $50,000 / violation)
If PHI reaches the wrong person
A patient calls to claim they received someone else’s statement in the mail. Report under your incident process as quickly as feasible maintain track of what was shared, to whom and when, and avoid future exposure.
Do not regard it as trivial. A recipient’s agreement to delete the statement may help with mitigation, but does not determine whether the incident needs to be reported. That call should come from your security or privacy lead.
Start with the records your team uses most
Pick a record your team touches every day and follow it through a shift. Who opens it? Where do copies land? Who decides what gets shared? You may find that nobody ever decided whether reports can be downloaded at home, or that an old shared folder still holds identifiable statements. Each of those is something specific you can fix.
Frequently Asked Question
PII is the broader term for information that identifies a person. PHI is identifiable information about health, care, or payment that a covered entity or business associate holds or sends. A patient's name on a balance report is PHI. An employee's Social Security number in an HR file is PII, but it isn't PHI.
Yes, if it identifies the patient. HHS uses a hospital bill as an example of PHI, and payment for care is enough on its own.
In a billing office, yes. An EOB ties a named patient to services, payment decisions, and what they owe.
On a patient account or claim, treat it as PHI. Health plan beneficiary numbers are on the list of 18 identifiers.
No, and be wary of anyone who hints otherwise. Payment depends on coverage, documentation, and payer decisions. What a company can commit to is response times, follow-up timelines, and honest reporting.
It can be. Account numbers are also on that list, and one linked to a person's care or payment record can still identify them.
No. A limited data set is still PHI, just with certain direct identifiers removed. It can be used for research, public health, or health care operations under a data use agreement.
No. Encryption controls who can read a file, while de-identification is about whether anyone can be identified from it. An encrypted patient report is still ePHI.
Yes. The Privacy Rule protects PHI in any form, including what's said out loud at the front desk or over the phone.
Swift Billing Solutions Team
Our team shares practical guidance on medical billing, coding, denial management, and revenue cycle operations. We write for physicians and practice managers who want to understand billing challenges, reduce avoidable errors, and keep payments moving.
