Tech & Innovation in Healthcare

Question: A coworker in our practice’s front office keeps telling me ePHI isn’t a thing and that I shouldn’t worry about it, but I disagree.

Which one of us is right?

Kansas Subscriber

Answer: You should absolutely prioritize every patient’s protected health information (PHI), regardless of whether the information is on paper or in an electronic format — also known as electronic PHI or ePHI.

PHI is best defined as “all ‘individually identifiable health information’ held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral,” reminds the HHS Office for Civil Rights (OCR) in its HIPAA Privacy Rule guidance.

The HIPAA Privacy Rule identifies 18 items as “individually identifiable health information” that are considered PHI:

1. Name
2. Address
3. Birth date and other corresponding dates of admission, discharge, death, etc.
4. Landline and cellphone numbers
5. Fax numbers
6. Email addresses
7. Social Security Number
8. Medical record number
9. Health plan beneficiary number (i.e. Medicare Beneficiary Identifier)
10. Account number
11. State identification or license number
12. Vehicle identifiers and serial numbers, including license plate numbers
13. Device identifiers and serial numbers
14. URLs
15. IP addresses
16. Biometric identifiers like finger or voice prints
17. Photo or image of patient, specifically the face
18. Any other unique code, characteristic, image, or number that identifies the individual.

The HIPAA Security Rule also protects certain information covered by the Privacy Rule, which includes “all individually identifiable health information a covered entity creates, receives, maintains or transmits in electronic form,” according to the U.S. Department of Health and Human Services (HHS) website.

Additionally, the Security Rule instructs covered entities (CEs), such as healthcare providers, health plans, or healthcare clearinghouses, to take the appropriate measures to protect ePHI through administrative, technical, and physical safeguards. You must never disclose PHI or ePHI to unauthorized persons, or you’ll be in violation of HIPAA’s Privacy and Security Rules.