PII vs PHI vs PCI: What's the Difference?

What does PII, PHI, and PCI each mean?

PII stands for Personally Identifiable Information. It is any data that can identify a specific person, on its own or combined with other data. Names, emails, phone numbers, addresses, government IDs, and IP addresses are all PII. It is the broadest of the three terms.

PHI stands for Protected Health Information. It is health data that is linked to a person and handled by a HIPAA-covered entity (like a hospital, clinic, or health insurer) or its business associates. PHI is a subset of PII that adds a health context, such as a diagnosis, a lab result, or a prescription tied to a named patient.

PCI usually refers to PCI DSS, the Payment Card Industry Data Security Standard. The data it protects is cardholder data: the primary account number (PAN), cardholder name, expiration date, and sensitive authentication data like the CVV. PCI is not a law. It is a contractual standard that any business storing, processing, or transmitting card data must follow.

So all three describe sensitive data, but they differ in scope and in who sets the rules. PII is the umbrella. PHI and PCI are narrower categories with their own dedicated frameworks.

What are examples of PII, PHI, and PCI data?

The fastest way to tell them apart is to look at concrete examples. The same person can generate all three types of data depending on the context they appear in.

• —PII examples: full name, email address, phone number, home address, date of birth, passport or national ID number, IP address, and login credentials.
• —PHI examples: a diagnosis tied to a patient name, lab results, treatment dates, medical record numbers, health insurance ID, and appointment notes that include identifiers.
• —PCI examples: the card number (PAN), cardholder name, expiration date, service code, and sensitive authentication data such as the CVV2 or full magnetic stripe.
• —Overlap example: "Maria Lopez, maria@example.com" is PII. Add "diagnosed with type 2 diabetes" at a clinic and it becomes PHI. Add her Visa ending 4242 at checkout and that card data is PCI.

How do PII, PHI, and PCI compare?

The table below shows the core differences side by side: what each covers, the main rules that govern it, and the typical scope.

What are the common confusions between these terms?

The biggest confusion is treating the three as separate, unrelated buckets. They are not. PHI and PCI are best understood as specialized types of PII. A patient's name is PII; that same name attached to a diagnosis becomes PHI; that same name attached to a card number becomes part of cardholder data under PCI.

Another mix-up is jurisdiction. PII is a general concept defined slightly differently across laws like GDPR (which uses the term "personal data"), CCPA, and others. PHI is specific to US HIPAA rules. PCI applies globally to anyone handling card payments, regardless of country, because it is set by the card brands, not a government.

Teams also confuse data categories with obligations. Calling data PHI does not change what the data is. It changes the legal duties around it: breach notification, access controls, and audit logging under HIPAA. The same is true for PCI DSS controls like tokenization and network segmentation.

Finally, redaction is often mistaken for anonymization. Removing a name from a record reduces risk, but residual data can still re-identify someone. Knowing which category you are handling tells you which standard you must meet before data can be considered safe to share.

How does Sanitext relate to PII, PHI, and PCI?

Sanitext is an API that detects and redacts identifiers in text. Because PHI and PCI both contain PII at their core, detecting the underlying identifiers is the common first step for all three.

Sanitext finds entities like names, emails, phone numbers, addresses, dates, account numbers, and card numbers, then masks them as labels like [FIRSTNAME] or [ACCOUNT]. POST /v1/detect returns the spans with offsets and scores. POST /v1/redact returns the text with those spans masked. It works across 30+ languages and runs on our own infrastructure, so raw text never goes to a third-party LLM.

Be clear on scope: Sanitext is a redaction and data-minimization aid, not an anonymization guarantee or a compliance certification. It helps you strip identifiers before text reaches logs, prompts, or analytics, which supports HIPAA de-identification work and PCI data-minimization efforts. It does not by itself make you HIPAA or PCI DSS compliant. Use it as one control inside a broader program.

FAQ