What Is ePHI and PHI?
Protected Health Information (PHI) is individually identifiable health information created, received, or maintained by a healthcare provider, health plan, or their business associates. When that same information is created, stored, or transmitted electronically, it is called electronic Protected Health Information (ePHI).
PHI and ePHI are not laws themselves — they are the category of data that laws such as HIPAA are written to protect. Understanding what counts as PHI/ePHI is the first step in deciding what needs to be backed up carefully, encrypted, and access-controlled.
PHI vs. ePHI: What's the Difference?
PHI
PHI covers health information in any form — paper records, spoken conversations, printed lab results, as well as electronic records. It is the broad, form-independent category.
ePHI
ePHI is the subset of PHI that exists in electronic form: database records, scanned documents, email messages, diagnostic image files, and any other digital record tied to an identifiable patient. Because it is digital, ePHI is what a medical data backup plan actually protects.
What Counts as PHI/ePHI: The 18 Identifiers
Health information becomes PHI when it can be linked to a specific person. U.S. federal guidance lists 18 identifiers that, combined with health data, make a record identifiable:
- Name
- Geographic subdivisions smaller than a state
- Dates related to an individual (birth, admission, discharge)
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers (finger or voice prints)
- Full-face photographs
- Any other unique identifying number or code
Note: Health data that has been fully de-identified — stripped of all 18 identifiers — is generally no longer considered PHI.
Where ePHI Lives in a Healthcare Organization
Clinical and Billing Systems. Electronic health/medical record (EHR/EMR) platforms, practice-management software, and billing databases running on MySQL, PostgreSQL, Microsoft SQL Server, or similar engines.
Documents and Diagnostic Files. Scanned intake forms, PDFs, exported reports, and diagnostic images (X-ray, CT, MRI, ultrasound) stored on local drives, shared folders, or a PACS system.
Email and Communication. Referral letters, lab results, and patient correspondence sent or received through organizational email accounts.
Endpoints and Removable Media. Clinic workstations, laptops, external drives, and portable devices where ePHI is cached, exported, or stored locally.
What This Means for Backup Planning
Because ePHI can be scattered across a database, a file share, an inbox, and a diagnostic imaging folder at the same time, a backup plan built around a single data source will miss part of it. Organizations handling ePHI typically need to:
- Inventory every system and folder where ePHI is created or stored, not just the primary database
- Apply encryption to backup archives and to data in transit to remote or cloud storage
- Keep multiple recovery points so a corrupted or compromised copy is not the only one available
- Control and log access to backup storage the same way access to the live system is controlled
These are the same technical safeguards addressed by the HIPAA Security Rule, which specifically governs ePHI. See our HIPAA glossary entry and HIPAA backup requirements guide for the regulatory side. For the software side, see how Handy Backup handles healthcare data backup.
FAQ
Is ePHI the same thing as HIPAA?
No. ePHI is the category of data (electronic protected health information). HIPAA is the U.S. federal law that sets rules for how covered entities and business associates must protect that data, primarily through the Security Rule.
Does a backup copy of ePHI need to be encrypted?
Under the HIPAA Security Rule, encryption is an addressable specification rather than a blanket requirement in every case. Organizations must assess the risk and document whether encryption is reasonable and appropriate for their backup workflow.
Are diagnostic images like X-rays and MRIs considered ePHI?
Yes, when the image file is linked to an identifiable patient. This applies whether the images are stored in a dedicated imaging system or as files on a shared network location.
Can de-identified health data be treated as regular data?
Once all 18 identifiers are removed and the data can no longer be linked back to an individual, it is generally no longer considered PHI. Re-identification risk should still be assessed before treating a dataset as fully de-identified.
Learn more:
- HIPAA
"HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that establishes rules for protecting health information. It applies to…" - Serial Attached SCSI (SAS)
"Serial Attached SCSI (SAS) , is a computer bus technology primarily designed for transfer of data to and from devices like hard drives, CD-ROM drives and…" - Docker Automatic Backup Software Solution
"Docker backup allows saving a configuration, status and data from a Docker container. To allow Docker backup data from container, users may implement a…"