PHI covers far more than diagnoses. Names, addresses, dates, contact details and payment information all become PHI when tied to health status, care or payment for care.
In telehealth this means intake responses, provider messages, prescription records, shipment addresses and much of the billing data are all in scope.
Practical handling means limiting who can see records, logging access, encrypting storage and transmission, and being deliberate about what appears in marketing tools and analytics.
Breach costs in healthcare are among the highest of any sector, and the obligation to notify patients lands on the brand they trusted, not on the vendor whose systems failed.
Protected health information (PHI), in practice
Once it is associated with their care or their payment for care, yes. This is why marketing tooling in telehealth needs the same care as clinical systems, and why segmenting on treatment type inside a general-purpose email platform is riskier than it looks.