HIPAA Glossary · Data & information types
ePHI
PHI in electronic form — the subset the Security Rule protects.
Context
ePHI is PHI held or transmitted electronically: databases, backups, email, laptops, phones, removable media, anything over a network. The Security Rule applies to ePHI specifically; paper PHI is covered by the Privacy Rule's safeguard requirements. Modern programmes treat almost everything as ePHI because almost everything ends up electronic eventually.
Related terms
- PHI — Protected health information — individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
- Security Rule — The HIPAA regulation requiring administrative, physical, and technical safeguards for ePHI.
- Encryption — Rendering data unreadable without a key. Addressable at rest and in transit under the Security Rule.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.