What Counts as PHI When Using AI? A Plain-Language Guide for Care Staff
AI & Technology

What Counts as PHI When Using AI? A Plain-Language Guide for Care Staff

June 30, 2026

Back to Blog

Most care staff have a general sense that they should not share 'private information' with AI tools - but the specifics matter enormously. Here is exactly what qualifies as Protected Health Information and what does not.

The Definition Matters More Than You Think

When facilities say "don't share private information with AI tools," they usually mean well but leave too much room for interpretation. "Private information" is vague. Staff make judgment calls, and those calls vary from person to person.

HIPAA is more specific. The Privacy Rule defines exactly what makes health information protected - and understanding that definition is the practical key to using AI tools confidently and safely.

The Foundational Rule

Under HIPAA, health information becomes Protected Health Information (PHI) when it meets two conditions:

  1. It relates to a person's physical or mental health condition, health care provision, or payment for health care, AND
  2. It can be used to identify the individual

Both conditions must be met. Health information without any identifying elements is not PHI. Identifying information without any health-related content is not PHI (though it may be protected by other privacy rules).

This matters for AI use because it means: if you remove the identifying elements, the health-related content is safe to share.

The 18 HIPAA Identifiers: The Complete List

HIPAA specifies exactly 18 categories of information that make health data identifiable. These are:

1. Names - Any name including nicknames.

2. Geographic data - Street address, city, county, ZIP code. State alone is generally safe.

3. Dates (other than year) directly related to an individual - Admission date, discharge date, date of birth, date of service. Year alone is generally safe.

4. Phone numbers

5. Fax numbers

6. Email addresses

7. Social Security numbers

8. Medical record numbers - Any internal identifier used by a facility to track a specific patient.

9. Health plan beneficiary numbers - Insurance member IDs.

10. Account numbers - Any financial account numbers.

11. Certificate and license numbers

12. Vehicle identifiers and serial numbers - Including license plates.

13. Device identifiers and serial numbers - Including medical device serial numbers.

14. Web URLs

15. IP addresses

16. Biometric identifiers - Fingerprints, voiceprints, retinal scans.

17. Full-face photographs and comparable images

18. Any other unique identifying number or code - A catch-all for anything that could identify a specific individual.

Practical Examples: PHI vs. Not PHI

PHI - do not enter into AI tools without a BAA:

  • "Mary Johnson has stage 2 dementia and responds to 1950s music"
  • "The participant in Room 214 has a new diagnosis of CHF"
  • "Our participant born 3/14/1941 is showing signs of depression"

Not PHI - safe to use in AI prompts:

  • "A participant in her mid-80s with stage 2 dementia responds well to 1950s music"
  • "A male participant in his late 70s has a new CHF diagnosis and struggles with fluid restriction"
  • "A participant with moderate memory challenges, former background in education, responds well to music and reminiscence"

The health information in the second set is identical to the first. The identifying link has been removed.

The Gray Areas

Age specificity. "Born in 1941" is an identifier. "In his mid-80s" is not. Use ranges.

Combinations of information. A room number alone is not PHI. But "the only 94-year-old male in our memory care unit" may be identifiable even without a name. Think about whether your description could identify a specific person to someone familiar with the facility.

Photographs. Full-face photographs are explicitly listed as identifiers. Never upload participant photographs to AI tools without appropriate consent and a BAA.

IDD and behavioral health participants. Diagnosis information for participants with IDD, mental health diagnoses, or substance use history may carry additional protections under state law or 42 CFR Part 2 beyond standard HIPAA.

The Safe Default: Pseudonymize Everything

Rather than evaluating each piece of information individually, the safest and most practical approach is a simple default rule:

Before describing any participant to an AI tool, replace their name with a pseudonym and remove all specific dates and location identifiers.

Everything else - age range, cognitive level, personality, interests, cultural background, care needs, and behavioral patterns - can remain in the prompt and will make the AI's output significantly more useful.

A Quick Reference Card

NEVER enter into AI tools: Name, room/bed number, date of birth, admission/discharge date, Social Security number, MRN, diagnosis combined with any identifier, specific family member names, photographs of participants

SAFE to include in AI prompts: Age range, cognitive stage or general functional level, personality and preferences, cultural or professional background, general care needs, behavioral patterns, interests and hobbies, activity participation history

When in doubt: replace names with "Participant A," remove specific dates, keep everything else.

More from the Blog

How DayGuide AI Runs the Operations Side of Your Activities Department

How DayGuide AI Runs the Operations Side of Your Activities Department

June 30, 2026

Why Using Pseudonyms with AI Is a Smart Privacy Move for Care Professionals

Why Using Pseudonyms with AI Is a Smart Privacy Move for Care Professionals

June 29, 2026

The Complete AI Policy Template for Adult Day Centers

The Complete AI Policy Template for Adult Day Centers

June 30, 2026

Ready to transform your activity program?

See how DayGuide AI saves activity directors 10+ hours per week.

Request a Free Demo