PHI vs PII: what's the difference for employers?

A doctor’s note in a personnel file feels like PHI. It names a condition and carries a clinic’s letterhead. Under HIPAA it almost never is, and that single label is where many HR teams start sorting their records into the wrong drawer.

PII is the wider idea: anything that points to a person. For an employer, the useful question is which rule follows each record and whether that rule lets it leave the building. The leaving part has its own checklist, our US list of identifiers to remove before sharing, field by field.

PHI vs PII: the two definitions side by side

PII has no single statute behind it. The federal definition most people quote is in OMB Circular A-130, written for agencies: information that can distinguish or trace someone’s identity, alone or combined with other linkable data. A name qualifies. So does an employee ID, for anyone who can look it up.

PHI has an owner. HIPAA defines it in 45 CFR 160.103 as individually identifiable health information, then lists what it leaves out. Two facts decide the label: who created or received the record, and in what role. The words on the page never settle it alone.

Picturing PHI as a smaller circle inside PII gets employers into trouble, so I skip that picture and ask who holds the paper. The words for what you do to a record afterward, de-identified or anonymized, are a separate vocabulary, sorted in our note on de-identified versus anonymized data.

Are employee medical records PHI? The employment records exclusion

The HIPAA definition of identifiable health information names employers in its first clause: information created or received by a provider, a health plan, an employer or a clearinghouse. Then the definition of PHI, in paragraph (2)(iii), takes out employment records held by a covered entity in its role as employer.

HHS says it plainly on its page for workers: the Privacy Rule doesn’t protect employment records, even health-related ones. An employer may ask an employee for a doctor’s note for sick leave or workers’ compensation. The doctor, though, can’t send that information to the employer without the patient’s authorization unless another law requires it.

Role is what trips up hospitals. A nurse’s sick note in HR is an employment record; her chart from the night she was admitted is PHI. I would keep those in separate systems with different people on each, since the chart answers to HIPAA and its business associate rules for AI tools.

When PII becomes PHI at work: the group health plan

There’s one door through which PHI reaches an ordinary employer: the group health plan it sponsors. The plan is a covered entity in its own right, separate from the company. What the plan’s insurer or administrator sends to the sponsor stays PHI, held for the plan, even when the readers sit in HR.

Not every plan counts. HIPAA’s definition covers a plan with 50 or more participants, or one administered by someone other than the employer that set it up. A small plan the company runs itself falls outside. Put your own plan into the check below.

When the plan does count, 45 CFR 164.504(f) builds a wall. The plan documents name which employees may see PHI and limit them to plan administration, and the sponsor certifies it won’t use the data for employment decisions. A claims report pasted into a chatbot with no BAA turns into the breach question.

If I ran benefits at a self-funded company, the claims export would never share a folder with the leave files. Checking one against the other is the temptation that certification exists to stop.

ADA, GINA and FMLA: the confidential medical file

Leaving HIPAA doesn’t leave a record unprotected. Three federal employment laws take over, each with its own size threshold. They don’t say PHI or PII. They speak of a confidential medical record, kept on separate forms and in separate files from the personnel file.

The ADA rule, 29 CFR 1630.14(c), names three groups who may be told, and the EEOC’s guidance applies it to medical details employees volunteer, too. GINA’s list runs to six cases, and family medical history counts as genetic information. An AI vendor appears on neither list.

This table fits into a staff AI policy as a single line, and mine would read: nothing from the separate medical file goes into a general AI tool until the person in it can no longer be identified.

Sensitive personal information: which state laws reach employees

State consumer privacy laws add a third label, sensitive personal information or sensitive data. Most were written for shoppers, not staff. Virginia’s defines a consumer as someone acting in an individual or household context and excludes anyone acting in an employment context. Washington’s My Health My Data Act carries the same exclusion.

California is the exception. The CCPA’s exemption for employee and applicant data became inoperative on January 1, 2023, so a CCPA business owes its California workers the rights it owes customers. Our guide to California privacy law and AI covers which companies count as a CCPA business.

Two exemptions change the sort. The CCPA leaves out PHI collected by a covered entity or business associate, so your plan’s claims data answers to HIPAA. It also leaves out medical information governed by California’s CMIA, whose section 56.20 bars employers from using or disclosing employees’ medical information without authorization.

With staff in several states, I would plan around California’s list even for people outside it, since a payroll register rarely splits cleanly by state. The Washington health data guide covers the customer data that law does reach.

PHI, PII or sensitive: classify the records in your HR files

Here is that sort applied to paper an HR office holds. Filter by label; a record can carry more than one. The California column applies only when your company is a CCPA business and the employee lives in California.

The rows that worry me are the dull ones. A payroll register doesn’t look medical, yet its dues column reveals union membership and its SSN column sits on the same sensitive list. For Social Security numbers before AI, the safe default is that the column never leaves.

Does PHI require more protection than PII before AI?

Not as a rule. In an employer’s hands, the tightest limits often sit on records that aren’t PHI at all: six cases for a caregiver leave request under GINA, three groups for an accommodation under the ADA. The label tells you which list to read, and the list tells you who may see the text.

None of those lists mentions software, and the regulations don’t say whether sending text to an AI vendor counts as disclosure. What the vendor does with the prompt afterward is a separate question about sharing and training.

California adds a risk assessment before processing sensitive personal information, under the CPPA rules in force since January 1, 2026. Processing employees’ data solely for pay, work authorization, benefits, required accommodation or wage reporting is exempt. Whether an AI summary of an accommodation file stays inside “solely” is something I’d put to counsel.

Software handles most of that sweep, and our comparison of PII redaction tools shows what each one catches. Someone who knows the workplace still reads the result, because a rare condition in a team of six points to one person as surely as a name.

Law firms and CPA firms holding a client’s HR file

The same records travel to outside firms. Defense counsel receives the accommodation letters and the charge; a CPA firm running payroll sees every dues deduction. Neither becomes a HIPAA covered entity, though a firm becomes a business associate when a covered entity hires it for work involving PHI.

The labels follow the paper: a client’s FMLA file is still an employment record at the firm, and its staff are still California consumers if the client is a CCPA business. Its own duty runs to the client, so the AI clause in an engagement letter says how those files meet AI tools.

I wouldn’t trust redaction alone to settle privilege in a litigation file, and our guide on redaction and privilege shows where it stops.

Before you paste: the name stays, the diagnosis travels

Sorting the file this way leaves most HR text usable. The medical fact or the category is often what the task needs; the employee’s identity rarely is. That’s the part to take out on your own computer, before any vendor holds it, and the original record keeps its legal label.

Where a record lands on this map depends on facts no article can see, such as who administers your plan or where each employee lives. Take it as general information, and have employment counsel confirm the PHI and California columns against your own files.

I’d leave the diagnosis in and the person out. For HR desks that draft with AI every week, Nonimo’s app for US offices swaps the identifiers for placeholders on the computer and restores them in the reply.

The mapping between placeholders and real values never leaves that computer, as our security page explains.

For a whole HR team, Nonimo for organizations covers the rollout.

Sources

• eCFR, 45 CFR 160.103: PHI and its exclusions, including employment records held as employer; group health plan test (50 participants or outside administration). 164.504(f) on the plan sponsor wall is on the same site.
• eCFR, 29 CFR 1630.14: ADA confidential medical files and the three exceptions. GINA’s 29 CFR 1635.9 and the FMLA’s 825.500(g) are on the same site.
• HHS, Employers and health information in the workplace: employment records outside the Privacy Rule; doctor’s notes; provider authorization (read via an Internet Archive copy).
• OMB, Circular A-130: the federal definition of personally identifiable information.
• NIST CSRC, glossary entry for PII: the same definition across NIST publications.
• EEOC, disability-related inquiries and medical exams of employees: confidentiality of medical information, including what employees volunteer.
• EEOC, which federal laws apply to a small business: the 15-employee threshold for the ADA and GINA.
• U.S. Department of Labor, Fact Sheet 28, the FMLA: covered employers.
• California Civil Code, 1798.140: sensitive personal information at (ae); 1798.145 holds the employee exemption’s end and the exemptions for PHI and CMIA medical information (read via an Internet Archive copy).
• California Civil Code, 56.20: employers’ duties for employees’ medical information (read via an Internet Archive copy). The CPPA’s risk assessment rule is 11 CCR 7150.
• Code of Virginia, 59.1-575: consumer excludes the employment context; sensitive data.
• Revised Code of Washington, 19.373.010: My Health My Data Act definitions, including the employment exclusion.

Checked on November 7, 2026.