Direct comparison
PII vs PHI: What Each Term Covers
PII vs PHI from the regulation text: the 2 CFR 200.1 and HIPAA definitions, what PHI excludes, and why the 18 identifiers test de-identification only.
Written and maintained by CASRAI Editorial Board
Last updated
Ask CASRAI · free to try
Ask about PII vs PHI: What Each Term Covers
Ask your first 2 questions free below. Subscribers get 150 a day for $29 a month.
An AI assistant specialized in research administration. It cites the sources behind every answer, labels web answers and says when it can't answer.
Answers draw on CASRAI's guides and dictionary plus the federal and funder documents we index: Federal Register, Grants.gov, Regulations.gov and UKRI.
Works on this site and inside Claude, Cursor and the AI tools you already use.
Everything CASRAI publishes — this page, the dictionary, the guides and the news — stays free to read, with no account and no card.
How do PII (2 CFR 200.1), PHI (45 CFR 160.103) compare side by side?
The table below compares PII (2 CFR 200.1), PHI (45 CFR 160.103) across 11 procurement-relevant dimensions, from where it is defined through source.
Side-by-side comparison
| Dimension | PII (2 CFR 200.1) | PHI (45 CFR 160.103) |
|---|---|---|
| Where it is defined | Federal grant rules: 2 CFR 200.1 (Uniform Guidance definitions). | HIPAA Administrative Simplification: 45 CFR 160.103. |
| Core definition | Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. | Individually identifiable health information that is transmitted or maintained in electronic media or in any other form or medium, subject to the exclusions below. |
| What kind of data | Not attached to any single category of information or technology; the rule calls for a case-by-case assessment of the specific risk that an individual can be identified. | Health information, including demographic information, created or received by a health care provider, health plan, employer or health care clearinghouse that relates to past, present or future physical or mental health, the provision of care, or payment for care, and that identifies the individual or gives a reasonable basis to believe it can identify the individual. |
| Public information | The rule notes that some PII is available in public sources such as telephone books, websites and university listings, and that non-PII can become PII whenever additional information is made publicly available. | The definition turns on identifiability and on the health-information elements above, not on whether a fact is also public. |
| Sub-category or exclusions | “Protected PII” is PII except for PII that must be disclosed by law. The rule’s examples include Social Security numbers, passport numbers, credit card and bank numbers, biometrics, date and place of birth, mother’s maiden name, and criminal, medical and financial records and educational transcripts. | Excluded from PHI: individually identifiable health information in FERPA education records (20 U.S.C. 1232g), records described at 20 U.S.C. 1232g(a)(4)(B)(iv), employment records held by a covered entity in its role as employer, and information about a person deceased more than 50 years. |
| Role of the 18 identifiers | The definition does not use a fixed identifier list; the Protected PII examples are illustrations, not a closed set. | The 18 identifiers in 45 CFR 164.514(b)(2)(i) are the Safe Harbor de-identification test. Removing them, with no actual knowledge that what remains could identify the individual, takes health information out of PHI. They are not a list that defines PHI. |
| When it stops being the thing | No fixed endpoint. Whether information is PII is reassessed as other information becomes available. | Health information that does not identify an individual, with no reasonable basis to believe it can be used to identify the individual, is not individually identifiable health information (45 CFR 164.514(a)). |
| Where they overlap | A health record that identifies a person can fit the PII definition; the rule itself lists medical records among its Protected PII examples. | The same record is PHI only when it meets the HIPAA definition and is not excluded. A student’s FERPA education record, for example, can be PII without being PHI. |
| Typical grant-office use | Grant terms and Uniform Guidance language. For example, 2 CFR 200.303(e) requires reasonable cybersecurity and other measures to safeguard information including protected PII. | Questions about data from HIPAA covered entities: authorizations, minimum necessary use, limited data sets and de-identification. |
| Which one applies to your project | Pick PII when the award terms, a data management plan or a federal grant condition uses that term, or when the data is identifiable but not health information held in a HIPAA context. | Pick PHI when the information is identifiable health information from a covered entity or its business associate and none of the HIPAA exclusions applies. If both fit, plan for both sets of obligations. |
| Source | eCFR, 2 CFR 200.1 (https://www.ecfr.gov/current/title-2/part-200/section-200.1), read 2026-10-29. 2 CFR 200.303 for the safeguarding clause. | eCFR, 45 CFR 160.103 (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) and 45 CFR 164.514 (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-29. |
Common questions
Common questions about PII (2 CFR 200.1) vs PHI (45 CFR 160.103)
Is PHI a type of PII?
+
Often, but the regulations do not define it that way. PII is defined in the federal grant rules at 2 CFR 200.1 and PHI in HIPAA at 45 CFR 160.103, and each definition has its own scope and exclusions. Identifiable health information held in a HIPAA context usually also fits the PII definition because it identifies a person, but PHI status depends on the HIPAA definition and exclusions, not on being PII.
Is a name PII or PHI?
+
A name can distinguish an individual, so it can be PII. It is also one of the 18 Safe Harbor identifiers in 45 CFR 164.514(b)(2)(i). A name becomes part of PHI when it is attached to individually identifiable health information, that is, information about a person’s health, care or payment for care that is created or received by a provider, health plan, employer or clearinghouse and is not excluded under 45 CFR 160.103.
Are student health records PHI?
+
Not if they are education records covered by FERPA. The PHI definition in 45 CFR 160.103 excludes individually identifiable health information in education records covered by FERPA (20 U.S.C. 1232g) and the treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv). Educational transcripts and medical records are both named among the Protected PII examples in 2 CFR 200.1, so such data may still call for PII-level protection.
Can PHI become non-PHI?
+
Yes. Under 45 CFR 164.514(a), health information that does not identify an individual, and with respect to which there is no reasonable basis to believe it can be used to identify an individual, is not individually identifiable health information. The Safe Harbor method removes the 18 listed identifiers and requires that the covered entity has no actual knowledge that the remaining information could identify the individual.
Is the list of 18 identifiers the definition of PHI?
+
No. The 18 identifiers are the Safe Harbor test for de-identifying health information under 45 CFR 164.514(b)(2). PHI is defined in 45 CFR 160.103 by what the information is (individually identifiable health information) and what is excluded, not by that list.
