HumenhukCIPP/US Study Guide
Chapter 8: Medical Privacy

PHI and ePHI Defined

Reviewed by Victor Humenhuk. Published . Reviewed .

PHI is individually identifiable health information held by a covered entity or business associate relating to a person's health, care, or payment. ePHI is PHI in electronic media - paper, paper-to-paper faxes, and voice telephone calls are NOT electronic media.

How this supports CIPP/US study

Use this lesson to separate sectoral scope, data type and regulated entity before testing an exception. Continue with the CIPP/US practice exam.

PHI is any individually identifiable health information transmitted or maintained in any form; held by a covered entity or business associate; that identifies or could identify the individual; created or received by a covered entity or employer; and relating to a past, present, or future condition, care, or payment.

Key terms - quick answers

What is “PHI”?
Protected health information: individually identifiable health information held by a covered entity or business associate that identifies or could identify the individual and relates to their health, care, or payment.
What is “ePHI”?
Electronic protected health information; PHI transmitted or maintained in electronic media such as hard drives, tapes, disks, or memory cards.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.