Agents are responsible for safeguarding client information at all times. Understanding the difference between Protected Health Information (PHI) and Personal Identifiable Information (PII) helps agents remain compliant with HIPAA, CMS, and carrier requirements when handling client records in MyMFG and other platforms.
Protected Health Information (PHI)
Protected Health Information (PHI) is an individual's health information that is created or received by a health care provider related to the provision of health care by a covered entity that identifies or could reasonably identify the individual.
Examples of PHI include:
Examples of PHI include:
Name
Dates related to health or identity (birth date, admission date, discharge date, death date)
Street address
Telephone number
Email address
Social Security number
Account numbers
License numbers
Medical record number
Device identifiers and serial numbers
Vehicle identifiers and serial numbers
Biometric identifiers (fingerprints, voiceprints)
Full face photos and comparable images
Any other unique identifying number, code, or characteristic
Personal Identifiable Information (PII)
Personal Identifiable Information (PII) is data or other information that identifies an individual or provides information about an individual in a way that is reasonably likely to enable identification of a specific person and make personal information about them known.
Examples of PII include:
Examples of PII include:
Name
Mother's maiden name
Social Security Number
Medicare Beneficiary Identifier (MBI)
Health Insurance Claim Number (HICN)
Bank account numbers
Date of Birth (DOB)
Driver's license
Passport number
Personal Health Information (PHI)
Biometric information
Telephone number
Credit card numbers
Device identifiers and serial numbers
Relatives' names
How PHI and PII Apply to Agents
When working in MyMFG, handling client enrollment documents, communicating with carriers, or submitting applications, agents must protect all PHI and PII from unauthorized access or disclosure. This includes securing physical documents, using encrypted communication channels when possible, and never sharing client information with unauthorized parties.
Violations of PHI or PII protections can result in penalties from CMS, carriers, and federal regulatory agencies.
Sources: CMS (2025), National Bureau of Economic Research (2025)