We proposed to define "individually identifiable health information" to mean information that is a subset of health information, including demographic information collected from an individual, and that:
(1) Is created by or received from a health care provider, health plan, employer, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and
(i) Which identifies the individual, or
(ii) With respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
In the final rule, we change "created by or received from a health care provider..." to "created or received by a health care provider... " in order to conform to the statute. We otherwise retain the definition of "individually identifiable health information" without change in the final rule.