PHI Distinction: Class I PHI is an operational subset of Class I Critical. The key trigger is whether a Business Associate Agreement (BAA) is required. Student health and counseling records are covered under FERPA (Class II), not HIPAA — only faculty/staff health data and third-party health vendor relationships fall here.