Under US Federal law, any information about health status, health care, or payment for health care created or collected by a Covered Entity (or a Business Associate of a Covered Entity) that can be linked to a specific individual. Protected health information (PHI) is usually broadly interpreted to cover any part of a patient's records, including payment history. PHI is protected under the US Health Insurance Portability and Accountability Act (HIPAA).