What Is ePHI, Exactly? The Scoping Test Behind the Definition

Electronic protected health information is, in the words of 45 CFR 160.103, "Information that comes within paragraphs (1)(i) or (1)(ii) of the definition of protected health information as specified in this section." Those two paragraphs are protected health information "Transmitted by electronic media" and "Maintained in electronic media". That is the entire definition, and it is a pointer rather than a description, which is why the useful question is not "what is ePHI" but "what test does a record have to pass to be ePHI". There are four, nested: is it health information, is it individually identifiable, is it held in the covered-entity chain, and is it transmitted or maintained electronically. The first three make it protected health information and bring the Privacy Rule; the fourth brings the Security Rule, whose applicability section at 164.302 is written against ePHI and nothing else.

Getting the four tests right is the scoping decision for a HIPAA programme. Getting them wrong in one direction leaves a backup or a log outside a risk analysis that the regulation says must cover all of it; getting them wrong in the other direction spends a security budget on data that is not regulated at all.

Key takeaways

• ePHI is defined by reference: protected health information that is transmitted by or maintained in electronic media. Everything turns on the definitions it points to.
• Individually identifiable health information has to relate to health, care or payment AND identify the individual or give "a reasonable basis to believe the information can be used to identify the individual." A bare identifier fails the first half; a pseudonymous health record fails the second half only if de-identified under the rule.
• Four exclusions sit inside the definition of protected health information itself: FERPA education records, certain student treatment records, employment records held by a covered entity as employer, and records of people deceased for more than 50 years.
• The Security Rule applies to ePHI a covered entity or business associate "creates, receives, maintains, or transmits", and the risk analysis must cover ePHI "held by" the entity. Those verbs, not a list of applications, define the scope.
• The Privacy Rule applies to protected health information in every form, and the Breach Notification Rule to unsecured protected health information. A record can be inside one rule and outside another, and the scoping record should say which.

Four nested definitions, read in order

The regulation builds ePHI from the inside out, and each layer is a filter.

Health information. Under 160.103, any information, including genetic information, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and relates to "the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual." Note the third limb. Payment records are health information, which is why a billing system is rarely out of scope.

Individually identifiable health information. Health information, including demographic information collected from an individual, that is created or received by a health care provider, health plan, employer or health care clearinghouse, relates to one of the three things above, and either "identifies the individual" or is information "With respect to which there is a reasonable basis to believe the information can be used to identify the individual." The reasonable-basis clause is the one engineers underestimate. It does not require a name. It requires that identification be reasonably possible, which is a question about what else the holder or a recipient could join the data against.

Protected health information. Individually identifiable health information that is "(i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium", minus four exclusions discussed below. Paper, conversation and electronic all qualify here; the medium does not matter yet.

Electronic protected health information. Protected health information within (1)(i) or (1)(ii) only. Now the medium matters. The regulation's definition of electronic media has two halves, storage and transmission: "Electronic storage material on which data is or may be recorded electronically", including storage devices and removable media, and "Transmission media used to exchange information already in electronic storage media", including the Internet and networks. Read both halves as scope: a record at rest on a disk and the same record in flight over a network are both ePHI.

This is why a one-sentence definition of ePHI is accurate and insufficient. It tells you what ePHI is. It does not tell you how to decide whether the row in front of you passes.

Where the definition lets go

Four categories are carved out of protected health information by 160.103 itself, and because ePHI is defined by reference, they are carved out of ePHI too. Individually identifiable health information "In education records covered by the Family Educational Rights and Privacy Act", in the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), "In employment records held by a covered entity in its role as employer", and "Regarding a person who has been deceased for more than 50 years."

The employer exclusion is the one that surprises health tech companies. A hospital's occupational-health file on its own nurse, held because the hospital is her employer, is not protected health information. The same hospital's clinical record of treating her as a patient is. Same person, same building, different capacity, and the capacity decides.

Two further exits are outside the definition and belong to other articles. De-identified information is no longer protected health information, but only when it is de-identified by one of the two methods the rule recognises, and de-identifying PHI owns the mechanics, including the list of identifiers that belongs to the safe harbor method rather than to the definition of PHI. And information with no covered entity anywhere in the chain never becomes protected health information at all, because the definitions above are written around providers, plans and clearinghouses and those who act for them; does HIPAA apply to my health app is the test for that.

Is an email address ePHI? Working the tests on hard cases

The definition answers this more precisely than intuition does, so work it rather than guess.

A bare email address. On its own it identifies, but it relates to nothing about health, care or payment, so it fails the first test and is not health information. In a marketing list at a gym, it is not ePHI.

The same email address in a provider's patient portal. Now it is collected by a health care provider, and its presence in that system records that the person is a patient of that provider, which is information about "the provision of health care to an individual". It identifies. It is maintained in electronic media. On the plain words of the definition it is ePHI, and the reading that "it is only an email address" ignores the context the definition makes decisive.

A pseudonymous record. A research extract keyed by a stable surrogate ID, with the dates and geography intact, held by a business associate. It relates to health. It does not name anyone. But the reasonable-basis clause asks whether the information can be used to identify the individual, and a stable key plus intact dates plus a mapping table somewhere in the organisation is exactly that. It remains ePHI unless de-identified under the rule, and the de-identification article explains why hashing does not get you there.

Metadata and logs. An application log line recording that user 4471 viewed the oncology results page at a given time is, on the definition, individually identifiable health information if user 4471 can reasonably be resolved to a person and the page view records something about their condition or care. Most access logs in health applications can be resolved, because that is what the log is for. The honest reading is that logs, audit trails, analytics events and message queues in a system that handles ePHI usually hold ePHI too, in fragments, and a scoping exercise that stops at the database has stopped early.

A backup. Protected health information "Maintained in electronic media". A backup is electronic storage material on which the data is recorded. It is ePHI for exactly as long as it exists, which is often longer than the production record.

Notice that none of these is decided by how sensitive the data feels. Each is decided by the three nested tests plus the medium.

Three rules, three scopes

The medium test matters because the three HIPAA rules are written against different objects, and a record can be inside one and outside another.

Read across a single record. A paper intake form is protected health information: the Privacy Rule's safeguards apply and a loss of it can be a breach, but the Security Rule's standards do not reach it. Scan the form and the scan is ePHI: all three rules now apply. Encrypt the scan by a method the HHS guidance specifies and it is no longer unsecured, so the individual-notification duty in 164.404, which is written against unsecured protected health information, no longer attaches to its loss, while the Privacy and Security Rules still do. The scoping record for a system should be able to say, for each store of data, which of the three columns it sits in.

The scoping procedure the Security Rule implies

The Security Rule does not give you a scoping method by name, but it gives you the verbs, and the verbs are the method.

164.306(a)(1) requires a covered entity or business associate to "Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits." 164.308(a)(1)(ii)(A) requires "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." All of it. Held. Four verbs.

So the procedure is a trace, run per verb, from each relationship that brings protected health information into the organisation.

Start from the relationships, not the systems. For a covered entity, each line of business that treats, insures or clears. For a business associate, each customer agreement under which you handle their information; 164.308(b)(1) permits a covered entity to let a business associate "create, receive, maintain, or transmit" ePHI on its behalf only with satisfactory assurances, and the agreement that carries those assurances is where your obligation starts. Do you need a BAA covers when that agreement is required.

Creates. Where does health information about an identifiable person come into being inside your systems? Clinical notes, claims, appointment records, device readings, chat transcripts with a care team, the derived fields your own code computes from any of them.

Receives. Every intake channel: integration endpoints, file uploads, email, fax-to-email gateways, support tickets with attachments, a customer's export dropped into shared storage.

Maintains. Every place a copy rests: the primary database, read replicas, backups and snapshots, search indexes, caches, data warehouses, analytics event stores, logs, the message queue that buffered the record on the way in, the laptop that synced a folder, and the removable media the definition of electronic media names explicitly. The 164.304 definition of a workstation is instructive here: it includes "electronic media stored in its immediate environment", so the USB drive in the desk drawer is inside the rule's idea of the workstation.

Transmits. Every path between two of the places above, internal and external, including the ones that exist because someone once needed a report and wired a nightly export.

The output is two artifacts: an inventory of the assets that create, receive, maintain or transmit ePHI, and a data-flow map of how it moves. The proposed Security Rule overhaul would make both express requirements, and its status is tracked separately; the argument for building them now is not the proposal, it is that a risk analysis over ePHI "held by" the entity cannot be accurate without knowing what is held and where.

What changes once something is ePHI

The classification is not a label. It attaches obligations, and knowing which is the point of the exercise.

The Security Rule's four general requirements in 164.306(a) attach: confidentiality, integrity and availability of all of it; protection against "reasonably anticipated threats or hazards"; protection against reasonably anticipated impermissible uses or disclosures; and workforce compliance. Every standard in Subpart C follows, with implementation specifications marked Required or Addressable under 164.306(d). Which safeguards those are, and in what order to build them, is the territory of the HIPAA compliance checklist for health tech, which this article does not restate.

The Privacy Rule's safeguards standard at 164.530(c) attaches, and did already, because the record was protected health information before it was electronic.

And the Breach Notification Rule's presumption at 164.402 attaches to any impermissible acquisition, access, use or disclosure of the unsecured version: presumed to be a breach "unless the covered entity or business associate demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment." How that assessment is run is owned by the breach risk assessment article. What matters for scoping is that the presumption only applies to data your inventory knows about; an unlisted backup does not make its loss less reportable, it makes the report late.

The honest caveat

If you are a single-product business associate with one customer, one database and one backup job, the four tests above are a morning's work with the CFR open, and the inventory fits on one page. Do it yourself, date it, and put it with your risk analysis.

The exercise becomes a project in three situations: when the estate has grown by acquisition or by years of integrations nobody documented; when the same infrastructure carries both regulated and unregulated data and the two populations have to be kept separable; and when the reasonable-basis clause is doing real work, because your "anonymised" analytics pipeline turns out to be pseudonymous. Those are the cases where an outside trace finds the message queue, the analytics store or the synced laptop that the internal diagram left off.

Where Top Floor fits

We run the trace and produce the inventory and data-flow map as the front end of a risk analysis under our HIPAA practice, and keep both current as the estate changes under Compliance as a Service. We do not offer legal conclusions on whether a particular record is protected health information; where a question turns on the reasonable-basis clause or on covered-entity status, we document the facts and the reading, and your counsel makes the call.

How to decide this week

List every relationship, customer or line of business through which health information about identifiable people enters your organisation. If the list is empty, you may have no ePHI at all, and the applicability article is the next thing to read.

Take one record from one of those relationships and follow it through all four verbs, writing down each system it touches, including the backup and the log. Compare the result with your current system inventory.

Then pick the store you are least sure about, usually analytics or logs, and run the three nested tests on a sample row. If it relates to health, care or payment and there is a reasonable basis to believe it can be tied to a person, it is in scope, whatever the store is called.

Frequently asked questions

What is the difference between PHI and ePHI?

Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate in any form or medium, minus four exclusions in 45 CFR 160.103. Electronic protected health information is the subset transmitted by or maintained in electronic media. The distinction matters because the Security Rule at 164.302 applies only to ePHI, while the Privacy Rule at 164.500 and the Breach Notification Rule at 164.402 apply to protected health information whatever its form. A paper record is PHI but not ePHI; scanning it makes it both.

Is an email address considered ePHI?

Only when it meets the whole definition. An email address by itself identifies a person but says nothing about health, care or payment, so it is not health information. Held by a health care provider in a system that records the person as a patient, it is collected by a covered entity, it identifies, and its presence relates to the provision of health care, so on the words of 45 CFR 160.103 it is individually identifiable health information and, if maintained electronically, ePHI. The context supplies the health element that the address alone lacks.

Does ePHI include logs, backups and metadata?

Usually, and the definition is why. Protected health information includes information "Maintained in electronic media", and electronic media includes any storage material on which data is recorded, so a backup of ePHI is ePHI. Logs and metadata are ePHI when they relate to an individual's health, care or payment and identify the person or give a reasonable basis to believe they can be identified, which an access log keyed to a user account in a clinical application typically does. The Security Rule requires the risk analysis to cover ePHI "held by" the entity, so these stores belong in the inventory.

Does the HIPAA Security Rule apply to paper records?

No. 45 CFR 164.302 requires compliance with the Security Rule "with respect to electronic protected health information", and ePHI is protected health information transmitted by or maintained in electronic media. Paper records are still protected health information, so the Privacy Rule's safeguards standard at 164.530(c) applies to them and their loss can be a breach of unsecured protected health information under 164.402. What paper records escape is the Security Rule's specific standards, not HIPAA.