What is the difference between PII, PHI, and personal data?

PII, PHI, and personal data all describe information tied to an individual, but they come from different legal and professional traditions and carry different obligations. Understanding the distinctions helps records and information governance teams classify, protect, and dispose of sensitive holdings correctly.

PII (Personally Identifiable Information)

PII is the most familiar U.S. term. It generally refers to any information that can be used to identify a specific person, either on its own or when combined with other data. Common examples include name, address, Social Security number, date of birth, and account or device identifiers.

PII is a broad, context-driven concept rather than a single fixed list. Some elements (such as a government ID number) are identifying on their own, while others (such as a ZIP code) become identifying only in combination. U.S. federal handling of records about individuals is shaped in large part by the Privacy Act of 1974.

PHI (Protected Health Information)

PHI is a narrower, regulated subset focused on health. In the U.S. it is defined under health-privacy rules and covers individually identifiable health information held or transmitted by covered entities and their business associates, such as providers, health plans, and clearinghouses.

In short: PHI is health-related PII that falls under a specific regulatory regime. Information becomes PHI because of who holds it and what it concerns, not merely because it relates to a person.

Personal Data

“Personal data” is the term used in many international and modern privacy frameworks. It is typically defined very broadly as any information relating to an identified or identifiable person. This often sweeps in more than traditional PII, including online identifiers, location data, and inferred characteristics.

How They Relate

• PII — broad U.S. concept; information that identifies a person.
• PHI — a regulated, health-specific subset of identifiable information.
• Personal data — the broadest, internationally oriented framing.

The categories overlap heavily, and a single record may qualify as more than one. Programs should map applicable laws to their holdings rather than assume one label fits all. For more guidance, see the privacy and PII topic hub.