Protected Health Information
Also called: PHI
Individually identifiable health information covered by HIPAA, which governs how clinical data may be used for AI development and deployment.
PHI is health information linked to an individual and held by a covered entity or business associate. Using it for model development requires an appropriate legal basis: patient authorization, an IRB waiver, a business associate agreement, or de-identification.
Where This Gets Misread
The practical question with any cloud-based clinical AI tool is where the data goes and what the vendor may do with it. A business associate agreement permits processing on the covered entity's behalf. It does not automatically permit the vendor to train its models on your patients' data, and that distinction lives in the contract rather than in the regulation.