Privacy & Data Protection
PHI (Protected Health Information)
PHI is health information tied to an identifiable person — diagnoses, treatments, health numbers. It carries the strictest handling rules of any routine business data.
Protected health information is individually-identifiable health data: conditions, medications, provider notes, health card numbers, appointment details. HIPAA defines it in the US; Canadian provinces protect it under statutes like Ontario's PHIPA and through PIPEDA's sensitivity principle.
PHI in an AI prompt is the highest-severity paste: health data triggers the strictest safeguard, consent, and breach-notification duties, and most AI tools' standard tiers are not covered by a BAA or equivalent. Clinical summarizing in a consumer chatbot is a reportable event waiting to be noticed.
Where this shows up
Related terms
See it in your own organization.
Sanitized AI inventories the AI tools in use and redacts sensitive data from prompts before it leaves.