PHI and ePHI both refer to protected health information under HIPAA, but the terms describe different formats. PHI can exist on paper, in a conversation, or in a digital record; ePHI is the portion created, received, stored, or transmitted electronically. Knowing the distinction helps health care organizations and their business associates apply the right safeguards. It also clarifies why an electronic medical record, a printed lab result, and a spoken patient update can all involve protected information, even though only some of them are ePHI.
What Does PHI Mean?
PHI stands for protected health information. Under the HIPAA Privacy Rule, it generally means individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. The information relates to a person’s past, present, or future physical or mental health, the provision of health care, or payment for health care.
For information to qualify as PHI, it must identify an individual or provide a reasonable basis to identify one. A name, address, birth date, medical record number, or other identifier may connect health details to a person. Information about a diagnosis with no identifying link may not be PHI, but context can make otherwise ordinary details identifying.
PHI can appear in many forms, including:
- Paper: A printed prescription, claim form, or patient chart.
- Spoken communication: A conversation about a patient’s treatment or bill.
- Electronic information: A record in an electronic health record system, an emailed lab result, or a digital insurance claim.
The HIPAA definition and related rules are set out in federal regulations, including 45 C.F.R. § 160.103.
What Does ePHI Mean?
ePHI means electronic protected health information. It is PHI that is created, received, maintained, or transmitted in electronic form by a HIPAA-covered entity or business associate. The “e” describes the format, not a different category of health information or a different level of sensitivity.
Examples include patient data in an electronic health record (EHR), a digital radiology image linked to a patient, an electronic prescription, a health plan’s claims database, or PHI sent through a network. ePHI can reside on servers, computers, mobile devices, removable media, or cloud services, depending on how an organization uses and manages those systems.
A paper chart does not become ePHI simply because it contains the same details as an electronic record. It remains PHI in paper form. If staff scan that chart and store the resulting file electronically, the electronic copy is ePHI. The original paper record remains PHI.
PHI vs. ePHI: The Key Difference
The clearest distinction is that PHI is the broader category, while ePHI is its electronic subset. Both can identify a person and relate to health care, health status, or payment. Their format determines which specific safeguards are relevant, especially under HIPAA’s Security Rule.
| Feature | PHI | ePHI |
|---|---|---|
| Meaning | Individually identifiable health information protected by HIPAA when held or transmitted by a covered entity or business associate | PHI created, received, maintained, or transmitted electronically |
| Format | Paper, spoken, or electronic | Electronic only |
| Examples | Printed chart, patient conversation, or digital record | EHR entry, electronic claim, or digital image linked to a patient |
| Main HIPAA protections | Privacy Rule applies across forms; other HIPAA requirements may also apply | Privacy Rule and Security Rule apply, along with relevant breach-notification requirements |
In everyday conversation, people sometimes use “PHI” to mean all protected health information, including electronic records. That broad usage is understandable. In compliance discussions, however, the distinction matters because the Security Rule specifically addresses ePHI.
How HIPAA’s Privacy and Security Rules Apply
The Privacy Rule Covers PHI in Any Form
The HIPAA Privacy Rule governs how covered entities and business associates may use and disclose PHI. It applies whether information is spoken, printed, or electronic. The rule generally requires appropriate protections and limits uses and disclosures to those permitted by HIPAA or authorized by the individual.
For example, a staff member should take care not to discuss a patient’s condition where unauthorized people can overhear. A clinic should also protect printed records from unauthorized access. Those safeguards concern PHI even when no computer or network is involved.
The Privacy Rule also gives individuals rights related to their health information, including rights to access certain records and request corrections. Details and official guidance are available from the U.S. Department of Health and Human Services (HHS) HIPAA Privacy Rule page.
The Security Rule Focuses on ePHI
The HIPAA Security Rule establishes requirements for protecting ePHI’s confidentiality, integrity, and availability. It requires regulated organizations to use administrative, physical, and technical safeguards. The rule is flexible and scalable: organizations assess their risks and select reasonable, appropriate measures based on factors such as their size, capabilities, and the nature of their systems.
- Administrative safeguards: Risk analysis, workforce training, security policies, and procedures for managing access and incidents.
- Physical safeguards: Controls for facilities, workstations, and devices that store or access ePHI.
- Technical safeguards: Measures such as access controls, audit controls, and protections for electronic data in transit or at rest, as appropriate to the organization’s risk assessment.
HIPAA does not prescribe one universal technology solution for every organization. Encryption is an important protective measure, but compliance involves more than turning on encryption. Organizations must assess risks, implement appropriate safeguards, and review whether those safeguards are working. See the HHS Security Rule resources and the regulation at 45 C.F.R. Part 164, Subpart C.
Who Must Protect PHI and ePHI?
HIPAA requirements apply to covered entities and, in relevant circumstances, their business associates. Covered entities include health plans, health care clearinghouses, and certain health care providers that conduct covered electronic transactions. Business associates are organizations or people that perform certain services involving PHI on behalf of a covered entity, such as claims processing, data analysis, or certain technology services.
A business associate generally must safeguard PHI under the HIPAA requirements and the terms of its business associate agreement. A cloud or technology vendor is not automatically a business associate in every situation; the relationship and the services performed matter. Organizations should assess how a vendor handles information and determine whether a business associate agreement is required.
HIPAA does not automatically cover every person or company that possesses health-related information. For instance, a consumer health app that is not acting for a covered entity or business associate may not be subject to HIPAA, though other federal or state privacy laws could apply. The data may be sensitive even when HIPAA does not govern the organization holding it.
What Information Is Not PHI Under HIPAA?
Not every health-related detail is PHI under HIPAA. The definition depends on the information, its identifiability, and who holds or transmits it. Some important exclusions and distinctions include:
- De-identified information: Information that meets HIPAA’s de-identification requirements is not PHI. HIPAA recognizes methods based on removing specified identifiers or obtaining an expert determination that the risk of identification is very small.
- Employment records: Employment records held by an employer in its role as an employer are generally excluded from HIPAA’s definition of PHI, even if they contain health information.
- Education records: Certain education records covered by the Family Educational Rights and Privacy Act (FERPA) are excluded from HIPAA’s PHI definition.
- Information held outside HIPAA-regulated relationships: A person’s health data does not become HIPAA-protected merely because it concerns health. The holder’s role and the applicable law matter.
De-identification is not the same as simply removing a patient’s name. HIPAA provides specific methods and conditions for determining that data is de-identified. Organizations should not assume that a dataset is outside HIPAA protection merely because obvious identifiers have been removed.
Common Examples of PHI and ePHI
Consider a patient’s test result linked to their name and date of birth. If the result is discussed during a care-team conversation, it is PHI in spoken form. If it appears on a printed report, it is PHI on paper. If it is stored in an EHR or sent electronically to an authorized provider, it is ePHI. The identifying health information is similar; the medium changes.
Other practical examples include:
- A paper appointment schedule showing patient names and appointment types: PHI.
- A digital appointment calendar linking names to specialty visits: potentially ePHI.
- A printed insurance explanation of benefits: PHI.
- A claim file transmitted electronically by a health plan: ePHI.
- A de-identified statistical report that meets HIPAA standards: generally not PHI.
Whether a particular item qualifies can depend on the surrounding context. A name alone is not necessarily PHI, and a diagnosis without an identifying connection may not be individually identifiable. But combining details can make someone identifiable, so organizations should evaluate information as a whole rather than reviewing fields in isolation.
How Organizations Can Protect PHI and ePHI
Effective protection begins with knowing what information an organization holds, where it is stored, how it moves, and who can access it. For ePHI, a documented risk analysis can help identify threats such as compromised accounts, lost devices, improper access, or insecure data transfers. The Security Rule requires regulated entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI.
Useful practices include limiting access to people who need information for their roles, promptly removing access when it is no longer appropriate, training staff, maintaining audit logs, and having procedures for responding to security incidents. Organizations should also consider device and facility protections, backups, secure disposal, and vendor oversight. The measures should reflect the organization’s risk assessment rather than rely on a generic checklist alone.
Paper and spoken PHI also need practical safeguards. Staff can use private areas for sensitive conversations, keep records away from public view, verify recipients before sending documents, and dispose of records securely. These steps support the Privacy Rule even when the information is not electronic.
What Happens After a PHI or ePHI Breach?
A breach can involve impermissible access, use, or disclosure of unsecured PHI, though HIPAA regulations include exceptions and a risk assessment process. The HIPAA Breach Notification Rule requires covered entities and business associates to provide notifications in certain situations. Requirements can vary based on the facts, including the number of affected individuals and whether a business associate is involved.
Organizations should have a process to identify, investigate, document, and respond to suspected incidents. Not every lost file or mistaken disclosure automatically results in the same notification obligations, and decisions should follow the applicable regulatory standards. HHS provides official information on the Breach Notification Rule.
Why the PHI and ePHI Difference Matters
The distinction helps organizations match safeguards to the risks of each format. PHI includes identifiable health information in any form; ePHI is that information in electronic form. HIPAA’s Privacy Rule applies to PHI broadly, while the Security Rule focuses on protecting ePHI. Understanding both terms supports clearer policies, better staff training, and more careful decisions about storing, sharing, and securing health information.