Privacy & Compliance
PII vs PHI vs PCI: What's the Difference?
- Personal data
- Health data
- Card data
Short answer
PII is any information that can identify a person. PHI is health information, held by a HIPAA covered entity or business associate, that identifies a patient. PCI data is payment card data, chiefly the card number, protected under the PCI DSS standard. The same record can be all three at once, and then all the rules apply.
PII, PHI and PCI at a glance
| PII | PHI | PCI data | |
|---|---|---|---|
| Stands for | Personally identifiable information | Protected health information | Payment card industry data (cardholder data) |
| Defined by | NIST SP 800-122 and many privacy laws (GDPR says "personal data") | HIPAA rules, 45 CFR 160.103 | PCI DSS, set by the PCI Security Standards Council |
| Examples | Name, email, phone, national ID, IP address | Diagnosis linked to a name, medical record number, treatment dates | Card number (PAN), cardholder name, expiry date, CVV |
| Who must protect it | Almost every organization | HIPAA covered entities and business associates | Anyone who stores, processes or transmits card data |
| Type of obligation | Law | US federal law | Contractual standard via card brands and acquirers |
What is PII?
NIST SP 800-122 describes PII as information that can be used to distinguish or trace an individual's identity, plus other information that is linked or linkable to that person. That covers obvious identifiers like a name, an email or a Social Security number, and less obvious ones like a date of birth combined with a postcode.
Outside the US, the term is usually "personal data". GDPR's definition is broader than most PII definitions: any information relating to an identified or identifiable person, explicitly including online identifiers and location data. If you work with EU data, plan for the GDPR meaning. See GDPR.
What is PHI?
Under HIPAA, PHI is individually identifiable health information held or transmitted by a covered entity (a health plan, a healthcare clearinghouse or a provider that bills electronically) or by its business associate, in any form. Health information about a person counts if it relates to their health, the care they receive or payment for that care, and it identifies them or could reasonably be used to.
Two consequences people often miss. First, the same blood-pressure reading is PHI in a hospital's records and generally not PHI in a fitness app run by a company outside HIPAA, though other laws may still apply. Second, de-identification under the Safe Harbor method means removing 18 types of identifiers, including names, geographic units smaller than a state, all dates except the year, phone numbers, email addresses, medical record numbers and full-face photos. See HIPAA.
What is PCI data?
The PCI Data Security Standard splits account data into two groups:
- Cardholder data: the primary account number (PAN), cardholder name, expiration date and service code. The PAN is what brings a system into scope.
- Sensitive authentication data: full track data, the card verification code (CVV/CVC) and PINs or PIN blocks. It must not be stored after authorization, even encrypted.
PCI DSS also limits what people can see: when a PAN is displayed, no more than the first six or eight digits (the BIN) and the last four should be visible unless there's a documented business need (Requirement 3.4.1 in v4.0.1). So 4532 7781 0021 9047 should appear as something like 4532 77 ** 9047. See PCI DSS.
Where do they overlap?
A clinic's billing note: "Ada Lovelace, MRN 448812, follow-up for hypertension on 3 March, paid with card 4532 7781 0021 9047." Her name is PII. Linked to the diagnosis and the record number, it's PHI. The card number is PCI data. If that note is pasted into an AI tool, HIPAA, PCI DSS and, for EU patients, GDPR all have something to say about it.
How should each be handled in AI prompts?
| Data | Recommended action | In Maskflare |
|---|---|---|
| PII | Mask reversibly so answers can use the real values again | Global and 47 country packs; GDPR, UK GDPR, US PII and Swiss nDSG profiles |
| PHI | Mask identifiers; keep clinical content only where the provider is covered by a business associate agreement | 11 healthcare detectors; HIPAA Safe Harbor profile; coverage report for the 18 identifiers |
| PAN | Mask, or block if no answer needs it | Validated card numbers (Luhn); PCI DSS v4.0 profile; partial action keeps the last four |
| CVV, PIN, track data | Block | Block rule |
| Secrets | Block | 232 credential and secret formats |
For your own identifiers, such as patient or customer numbers, Exact Data Match compares keyed hashes of your records, so the clear values never leave your environment. The compliance coverage report exports as CSV or PDF for your evidence file.
What are the limits?
Clinical free text is hard: a note can identify a patient through context alone, with no name in it. Whether data is PHI depends on who holds it, which no detector can tell. And masking is a safeguard, not certification: Maskflare doesn't make you HIPAA or PCI DSS compliant, and its SOC 2 Type II and ISO 27001 audits are in progress. As of October 2026, check the current HHS and PCI SSC texts. This is not legal advice.
Frequently asked questions
Is PHI a type of PII?
Yes, in practice. PHI is identifiable health information, so it's PII with health context, plus HIPAA rules that apply only to covered entities and their business associates.
Is a credit card number PII?
It's usually treated as personal data because it links to a person, and it's also PCI data under PCI DSS. Treat it as both.
Is an email address PHI?
On its own, no. In a covered entity's records linked to a patient's care, yes. It's also one of the 18 Safe Harbor identifiers.
Can I send PHI to an AI provider?
Only under a business associate agreement that covers the provider service you use. As of October 2026, check each provider's terms. Masking the identifiers first reduces what the provider receives.
Does masking card numbers take a system out of PCI scope?
It can reduce scope, but the systems that see the original PAN stay in scope. Confirm with your qualified security assessor.