ePHI is electronic protected health information: patient health information that is sent or stored electronically. The legal definition is in 45 CFR 160.103. ePHI lives in far more than your electronic health record (EHR). It is in email, texts, voicemails, scheduling apps, website forms, mobile devices, and cloud backups. The HIPAA Security Rule sets the rules for protecting it.
In February 2024, Montefiore Medical Center paid $4.75 million after a former employee stole the ePHI of 12,517 patients from electronic systems over a six-month period. OCR’s investigation found the health system had not analyzed the risks to ePHI stored across its electronic systems. The case shows a common mistake: thinking ePHI lives in one system, when it really moves through many of them.
Where ePHI Actually Lives in Your Practice
Most practices think ePHI means whatever is inside their EHR. That assumption creates blind spots, and those blind spots are where breaches can happen. Understanding what qualifies as ePHI, where it actually resides, and what the Security Rule demands is the foundation of any real compliance program.
What Qualifies as ePHI?
Under 45 CFR 160.103, ePHI is protected health information that is transmitted by electronic media or maintained in electronic media. In plain words, it is patient health information that is sent or stored electronically. Electronic media means things like hard drives, memory cards, and networks such as the internet. That definition is deliberately broad. If a piece of data identifies a patient (or could reasonably be used to identify one) and relates to their health condition, treatment, or payment, and it exists electronically, it is ePHI.
ePHI does not include paper records or verbal communications. A handwritten chart note is PHI, but not ePHI. A hallway conversation between clinicians is PHI, but not ePHI. The moment that same information enters an electronic system (scanned, dictated into a recording, or typed into a portal message), it becomes ePHI and falls under the Security Rule.
Common examples include EHR data, emails containing patient information, digital X-rays, electronic billing records, voicemails, text messages, data on USB drives, cloud backups, and scheduling software databases.
The Places Practices Overlook
People are somewhat used to HIPAA by now. It has been around for a long time. But familiarity breeds complacency.
Scheduling apps and website contact forms are excellent examples. A patient books an appointment through an online scheduler and enters their name, date of birth, and reason for the visit. That data is ePHI the moment the form is submitted. If the scheduling platform lacks proper safeguards, the practice has an exposure it may not even know about.
Email is another persistent problem. People send emails laden with PHI that are not encrypted, in a non-compliant fashion, countless times every day. An office manager forwards lab results using standard Gmail. A billing coordinator emails a claims spreadsheet to an accountant. Each instance creates ePHI in transit and at rest: in sent folders, inboxes, and server logs. For more on this, see the HIPAA rules for emailing PHI.
Mobile devices remain one of the biggest blind spots. A physician who checks patient messages on a personal phone has ePHI on that device. If the phone lacks encryption, a passcode, or remote wipe capability, one lost device can become a reportable breach. The same applies to tablets, laptops, USB drives, and any portable media.
Cloud applications add another layer. Cloud-based fax services, hosted phone systems that store voicemails, and third-party analytics platforms all contain ePHI if they process patient data. Each requires a Business Associate Agreement and appropriate safeguards. Practices using AI tools should also understand what counts as PHI in AI prompts, since patient data entered into an AI system is ePHI.
How the Security Rule Protects ePHI
The HIPAA Security Rule (45 CFR Part 164 Subpart C) exists specifically to govern ePHI. While the Privacy Rule addresses who can access and disclose PHI in any form, the Security Rule focuses on the technical and operational controls required to protect health information in electronic systems.
The Security Rule organizes safeguards into three main categories:
Administrative safeguards cover policies, procedures, and workforce training. This includes risk assessments, designating a security officer, and access management procedures. A thorough HIPAA risk assessment (the rule calls it a risk analysis) is required under 45 CFR 164.308. It is one of the administrative safeguards. It shows which risks your other safeguards need to deal with.
Physical safeguards address the tangible protections for hardware and facilities. Only the people who need it should be able to get into server rooms and other places that hold ePHI systems. Set up workstations so only the people allowed to use them can. Have rules for devices and anything else that stores ePHI, covering how they come in, move around, and leave. Those rules should include wiping ePHI before a device is thrown out or reused.
Technical safeguards deal with the technology controls that protect ePHI during storage and transmission. This includes access controls (such as unique logins and automatic logoff), audit logs, integrity controls, and transmission security. Encryption and multi-factor authentication are two of the most critical technical safeguards.
Securing ePHI in Practice
Compliance starts with knowing where ePHI exists. That means mapping every system, device, and application that creates, receives, maintains, or transmits patient data. Most practices are surprised by the length of that list.
Once the inventory is complete, each location needs appropriate safeguards. Encryption should protect ePHI both at rest and in transit. Access should follow the minimum necessary standard: each person on your team sees only the patient data their job needs. Audit logs should track who accessed what and when.
Under the current Security Rule, encryption is “addressable.” That does not mean optional. You must use it if it is reasonable and appropriate for your practice. If it is not, write down why.
Then use another measure that works as well, if one is reasonable. The current rule does not name multi-factor authentication (a second login step, such as a code sent to your phone). A proposed update to the Security Rule came out in January 2025. It would make both encryption and multi-factor authentication required. That proposal is not final.
Workforce training matters as much as technology. Staff need to understand that forwarding a patient’s record by unencrypted email, saving a file to a personal device, or texting about a patient all create ePHI exposures. Policies only work when people follow them.
Every vendor that handles ePHI needs a Business Associate Agreement. That includes EHR vendors, cloud hosting providers, IT support companies, and any other vendor that creates, receives, keeps, or sends patient data for you in electronic form.
FAQs
Is a patient’s name alone considered ePHI? A name on its own, with no link to health care, is not ePHI. It becomes ePHI when it is stored or sent electronically with health information.
That can be a diagnosis, a treatment record, or a payment detail. It can even be just the fact that the person is your patient. A name in an appointment reminder that references a procedure is ePHI. A name on a generic mailing list with no health context is not.
Are paper records considered ePHI? No. Paper records are PHI, but the “e” in ePHI stands for electronic. Paper records fall under the Privacy Rule’s protections but not the Security Rule’s technical requirements. However, once a paper record is scanned, photographed, or otherwise turned into an electronic file, that electronic copy is ePHI.
Does ePHI include data stored in cloud applications? Yes. Any cloud-based system that stores, processes, or transmits identifiable patient data contains ePHI. This includes cloud EHRs, hosted email platforms, cloud fax services, online scheduling tools, and cloud backup solutions. Each requires a Business Associate Agreement and appropriate security controls.
What is the difference between PHI and ePHI? PHI is the broader category. It includes identifiable health information in any form, whether spoken, written on paper, or stored electronically. ePHI is the subset of PHI that exists in electronic form. The Privacy Rule governs all PHI. The Security Rule governs only ePHI, adding specific technical, physical, and administrative safeguard requirements.
Sources
- 45 CFR 160.103, Definitions (ePHI, PHI, covered entity): 45 CFR 160.103 definitions
- HHS Security Rule Guidance: HHS Security Rule guidance
- Montefiore Medical Center Settlement (February 2024): Montefiore Medical Center settlement agreement
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: NIST SP 800-66 Rev. 2 HIPAA Security Rule guidance
One Guy Consulting offers affordable HIPAA compliance packages for practices of all sizes. Learn more about One Guy Consulting