Glossary
ePHI (electronic protected health information)
Also called: Electronic PHI
In one sentence
ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
PHI covers patient information in any form, including paper and spoken conversations. ePHI is the electronic subset: anything on a computer, server, phone, USB drive, cloud service, email, fax server, backup, or imaging system. The HIPAA Security Rule applies specifically to ePHI, which is why it's the term IT people use most.
In a typical small practice, ePHI lives in more places than people expect: the practice-management or EHR (electronic health record) system, the imaging software, scanned documents, emails with attachments, spreadsheets on the desktop, the e-fax inbox, phone voicemails delivered as email, and every backup copy of all of the above.
Why it matters: the Security Rule asks you to protect the confidentiality, integrity and availability of all ePHI you create, receive, maintain or transmit. Confidentiality means only the right people see it. Integrity means it isn't changed or destroyed improperly. Availability means it's there when you need it — which is why ransomware and long internet outages are HIPAA issues, not just IT inconveniences.
Example: a dental office believes its patient data is all in the cloud practice software. A quick inventory finds X-ray images on the imaging PC's local drive, a folder of scanned insurance cards on the office manager's desktop and old exports on a USB stick in a drawer. Each of those copies needs encryption at rest, access controls and backups — or needs to be moved somewhere that has them.
Our HIPAA security checklist tool is a quick way to see where your gaps are.
Related terms
- PHI (protected health information)PHI is any health information that can be linked to a specific person and is created or held by a healthcare provider, health plan or their vendors.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.
- Encryption at restScrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
- Encryption in transitProtecting data while it travels between devices or across the internet, so it can’t be read or altered on the way.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.