FREE TRIAL
Login

Improving HIPAA Compliance: Actually Understanding What Is PHI?

5 min read

Posted On January 14, 2021

medical-record-personal-health-information-HIPAA-compliance

What is PHI?

PHI stands for protected health information. In simple terms, PHI refers to any piece of information that a healthcare provider stores in patient medical records that can be used to personally identify an individual.

All organizations covered under the Health Insurance Portability and Accountability Act (HIPAA) are mandated to safeguard PHI. As such, in order to remain HIPAA compliant, healthcare organizations need to know precisely what is considered PHI.

What Is PHI Under HIPAA?

Any individually identifiable health information that is used, stored, or transmitted by a HIPAA covered entity is considered PHI under HIPAA.

This includes any information that relates to the provision of healthcare or payment for healthcare services – such as health records, health histories, test results and billing information.

To be clear, a HIPAA covered entity is any healthcare provider, health plan, health insurer, or healthcare clearing house.
In addition, any business associate of a HIPAA covered entity that uses, stores, maintains or transmits health information or PHI on behalf of the covered entity is also mandated to safeguard that information under HIPAA Rules.

To ensure HIPAA compliance, business associates must sign a business associate agreement (BAA) with the healthcare provider, which stipulates who is responsible for safeguarding PHI in line with the HIPAA Security Rule and the HIPAA Privacy Rule.

Read more: What Is a BAA?

What Are Individual Identifiers?

Individual identifiers are pieces of information that match any health-related information with an individual.

PHI individual identifiers

(Image source: totalhipaa.com)

The most common examples of individual identifiers include:

  • Patient name
  • Address (anything smaller than a State, such as street address, city, county, or zip code)
  • Dates (excluding years) that are directly related to an individual, including date of birth, date of death and date of admission or discharge
  • Telephone and fax numbers
  • Email address
  • Social Security number
  • Medical record number
  • Account number
  • Certificate/license number
  • Health plan beneficiary number
  • Vehicle identifiers, such as serial numbers or license plates
  • Web URLs
  • Device identifiers or serial numbers
  • IP address
  • Biometric identifiers such as fingerprints, retinal scans or voice prints
  • Full face photographs
  • Any other unique identifying number, characteristic, or code

When health information contains any one or more of these identifiers, that information becomes PHI – and must be adequately protected through technical, physical and administrative safeguards as stipulated in the HIPAA Security Rule.

Read more: Technical, Physical and Administrative Safeguards

Electronic Protected Health Information (ePHI)

Importantly, HIPAA Rules apply to both paper and electronic health information.

When PHI is created, used, shared or stored electronically – such as in an electronic health record (EHR) – it is known as electronic protected health information or ePHI.

Both the Privacy Rule (which limits uses and disclosures of PHI) and the Security Rule (which addresses the technical, physical and administrative safeguards healthcare organizations must have in place) apply to PHI and ePHI in equal measure.

BOOK YOUR FREE DATA ASSESSMENT

ePHI and Cloud Storage

Today, nearly all HIPAA covered entities deal with ePHI.

As such, in order to comply with the Security Rule and avoid HIPAA violations, HIPAA covered entities must, according to the legislation, “Establish and implement procedures to create and maintain retrievable exact copies of electronic Protected Health Information.

In addition, healthcare organizations must establish a data disaster recovery plan to “restore any loss of data in the event of a cyberattack, system outage, or damage to computers/servers where ePHI is stored.

Learn more: 5-Step Guide to Create Your Own Disaster Recovery Plan

Healthcare providers essentially have two options in this regard – implement and maintain their own data backup and recovery storage facility (an expensive, complex and time-consuming affair), or utilize the professional services of a cloud storage provider (by far the most reliable and cost-effective option).

When selecting a backup and recovery provider, however, it’s important to remember that not all cloud storage solutions are created equally.

Different providers offer different levels of support and service.

Some simply provide a software solution, rather than a full service to help you meet your HIPAA requirements.

Many popular data storage services – including Dropbox, Amazon Web Services (AWS) and Google – do not provide out-of-the-box HIPAA compliant cloud storage by design.

It is possible to use these solutions to store ePHI in a HIPAA compliant way – however, it is down to you to configure the respective systems yourself to ensure you meet the requirements of the legislation.

Other services, including WeTransfer and Apple iCloud, will not sign a BAA with HIPAA covered entities and so must be avoided altogether.

The best solution, therefore, is to work with a HIPAA compliant backup and data recovery specialist – one that provides not only software, but a full-service including data storage support and ongoing guidance for best practices regarding ePHI protection and HIPAA compliance.

BOOK YOUR FREE DATA ASSESSMENT

At Central Data Storage, not only are our cloud backup and recovery solutions amongst the most secure in the industry, but you will also work hand in hand with friendly experts who make it their business to ensure your ePHI is always protected and recoverable.

Our HIPAA compliant cloud storage specialists will help you develop policies, procedures, training programs and disaster recovery plans to make sure your whole business is in full compliance with HIPAA and your ePHI 100% recoverable in the event of a data disaster.

Our clients put it best:

We chose to work with Central Data Storage because as a dental clinic we needed to not only ensure our data was backed up and available, but that it was HIPAA-compliant at all times. The Central Data Storage team have been great to work with – very friendly, always on hand to help and clearly experts when it comes to data recovery management. Thank you."

Dr. Condello @ Oceans Dental


Talk to us here at Central Data Storage. As well as offering HIPAA compliant backup and recovery, CDS is also a leading provider of HIPAA compliant Encrypted File Sharing solutions.

Contact our friendly team today. Call 1-888-907-1227 or email info@centraldatastorage.com.

Free Backup and Recovery Data Assessment