PHI collected by private entities that receive no state or federal funding whatsoever is still PHI and has the same PHI protections as data collected by the government directly. "Public information" doesn't play any role here.