Protected health information (PHI) and ePHI

At a clinic, PHI includes the appointment list, the insurance card scan, the callback note and the patient details staff type into chat. ePHI is any of that information in electronic form. This entry explains what counts as PHI, where it appears in daily clinic work, what falls outside it, and which federal rules define it.

What is protected health information (PHI)?

PHI is individually identifiable health information that a covered entity or business associate creates, holds or transmits. ePHI is the same information when it is created, stored or sent electronically, for example in an EHR, email, a scheduling system or a staff chat.

Information is PHI when it meets all three of these conditions:

• It relates to a person's health, their care, or payment for that care.
• It identifies the person, or could reasonably be used to identify them.
• A covered entity or business associate holds it.

In practice at a clinic or small practice

The front desk and nursing staff handle PHI all day. Common examples:

• The day's appointment list
• A photo of a patient's insurance card
• A callback note such as "Mr. Lopez called about his lab results"
• A referral fax
• A patient's name and visit reason typed into a staff group chat

A patient's name on its own can become PHI. That happens once the name is linked to care or payment at your clinic. "Maria Chen" is just a name. "Maria Chen, 2:30 follow-up" on your schedule is PHI.

For the office manager, the key point is that much PHI becomes ePHI the moment someone types, scans or records it. That includes voice notes, screenshots, and files saved in shared drives. Any tool that stores or sends ePHI needs two things before staff use it for PHI: a signed business associate agreement (BAA) and the correct settings. This applies to email, staff chat and cloud storage alike.

A common gap is staff using personal texting apps without a BAA, for example to ask a colleague to "call back the patient in room 3 about her MRI."

Not to be confused with

De-identified data. Health information is no longer PHI once identifiers have been removed under one of the HHS methods. Learn more about de-identified data. Removing only the patient's name is not enough.

Health data outside HIPAA. Some health information is generally not PHI under HIPAA:

• Data a person enters into a consumer fitness app
• Employment records a clinic keeps in its role as an employer, such as a staff member's sick note in an HR file

Other privacy laws may still apply to this information.

What the rules say

• Definitions. The HIPAA Administrative Simplification rules define both PHI and electronic PHI in 45 CFR 160.103.
• Exclusions. These are not PHI:
  • Education records covered by FERPA
  • Employment records a covered entity holds in its role as employer
  • Information about a person who has been dead for more than 50 years
• Scope of each rule. The HIPAA Privacy Rule covers PHI in any form: paper, spoken or electronic. The HIPAA Security Rule covers only ePHI. A conversation at the front desk falls under the Privacy Rule. The same detail typed into a chat falls under both rules.
• Identifiers. The Safe Harbor de-identification method in 45 CFR 164.514(b)(2) lists 18 identifiers. Examples include names, dates related to the individual, phone numbers and medical record numbers. The list works as a practical checklist for what makes data identifiable.
• Primary source. For authoritative wording, use the HHS Office for Civil Rights guidance pages on PHI and de-identification.

This entry is a plain-language reference for staff training, not legal advice. Confirm specific situations with your privacy officer or counsel.

Related reading

• HIPAA: the federal law and rules that define PHI and how it must be protected.
• Business associate agreement (BAA): the contract required before a vendor handles PHI for you.
• HIPAA-compliant chat for staff: how internal staff messaging fits with PHI safeguards.

More definitions are in the healthcare operations glossary.