Identify the PHI You Will Handle

If you're building or scaling a HIPAA-regulated SaaS product, one of the first, and most important things you need to do is identify exactly what Protected Health Information (PHI) your system touches.

It’s not just about medical records. HIPAA defines 18 specific identifiers that, when tied to health-related data, constitute PHI. Understanding this list is crucial for your architecture, compliance planning, vendor selection, and product features.

What Is PHI?

Protected Health Information (PHI) is any health information that can be tied to an individual. That includes diagnoses, treatment data, test results, insurance information, and more, but only when linked to an individual’s identity.

So, a blood pressure reading alone? Not PHI.
A blood pressure reading tied to a name or email address? PHI.

The 18 HIPAA Identifiers of PHI

Below is the official list of identifiers that convert otherwise general health data into regulated PHI when linked to a person:

Source: U.S. Department of Health & Human Services (45 CFR § 164.514(b)(2))

What SaaS Startups Should Do

Make a spreadsheet or database that lists every user data element your system collects or stores. Tag each one that falls into one of the 18 categories.

• Metadata (like IPs, device IDs)
• Uploads (photos, PDFs)
• Support tickets (users may share PHI here)

You may expose PHI in:

• Analytics tools
• Logging platforms
• Customer support systems
• Third-party integrations (Zapier, Slack, etc.)

4. Document Everything
Every PHI interaction should be logged and justified. This helps with audits, risk assessments, and your HIPAA documentation.

Common Startup Mistakes

• Assuming email isn’t PHI: If you collect email and discuss health services, it’s PHI.
• Using non-HIPAA analytics or email tools: Many SaaS tools are not HIPAA-compliant and will not sign a BAA.
• Forgetting dev/test environments: PHI often leaks into staging data or QA systems.

Final Thought: HIPAA is About the Data

Too many startups think HIPAA is just a legal checkbox or hosting choice. In reality, HIPAA compliance starts with understanding what you're protecting, and that begins with the 18 identifiers above.

If you’re unsure whether a data point qualifies as PHI, assume it does until you can confidently rule it out.


Need Help? Security Ideals Has You Covered

At Security Ideals, we specialize in helping healthcare SaaS startups navigate HIPAA compliance from day one. Whether you're just getting started or preparing for enterprise sales, we offer:

• PHI Mapping + Data Flow Diagrams
• HIPAA Security and Privacy Policies
• Risk assessment
• Incident Response Training
• Vendor evaluations
• Pre-audit compliance checks
• Application penetration testing
• And Much More

We offer packages and services for every stage and every budget, from lean startups to scaling growth. If you're not sure where to start, let’s talk. We’ll help you move forward with clarity and confidence.