Information that is a subset of health information, including demographic information collected from an individual, and:
(1) Is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual; and
(i) That identifies the individual; or
(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.
NIST SP 800-66 Rev. 1
(45 C.F.R., Sec. 160.103)