[hn_throwaway_99]

Thanks, you're correct. I didn't mean to imply that PHI was defined by willingness to share it, I meant that the whole reason for "protecting" HI in the first place is for giving control over that information to the people it's about.

A specific example: I work on an app that does include HIPAA-regulated PHI, and sometimes I'll demo stuff in production by demoing my own personal account. I usually preface it by saying "This is my account, so it's OK to share" so folks know I haven't just pulled up someone else's data. If I had pulled up someone else's data and shared it without their consent, that would be a HIPAA violation.