{"head":{"title":"What Is ePHI (Electronic Protected Health Info)? | OceanLab","description":"ePHI is protected health information stored or sent electronically, the data the HIPAA Security Rule protects. What it covers and the safeguards.","canonical":"https://oceanlab.in/glossary/ephi"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"ePHI","path":"/glossary/ephi"}],"slug":"ephi","term":"ePHI (electronic protected health information)","aka":["electronic protected health information","EPHI"],"category":"Compliance","short":"Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.","body":[["45 CFR 160.103 defines electronic protected health information as ",{"href":"/glossary/phi","text":"PHI"}," that is sent by or kept in electronic media. In practice that is nearly all PHI a software product touches: database records, files, backups, logs, emails and API payloads."],["The HIPAA Security Rule (45 CFR Part 164 Subpart C) sets the safeguards for ePHI: administrative (risk analysis, training), physical (facility and device controls) and technical (access control, audit controls, integrity and transmission security)."]],"why":["The Security Rule is where HIPAA turns into engineering work. Knowing where ePHI lives in your system tells you which parts need access control, audit logs, ",{"href":"/glossary/encryption-at-rest","text":"encryption at rest"},", ",{"href":"/glossary/encryption-in-transit","text":"encryption in transit"}," and backups that meet the rule."],"example":["A telehealth app keeps visit notes in a database, video recordings in object storage, and appointment reminders in an email service. All three hold ePHI. The team maps each one, restricts access by role, logs who opened what, and encrypts the data stored and moving between them."],"inBuild":["A data map of every place ePHI is stored or sent, including logs and backups, is one of the first documents a health product build should produce."],"mistakes":[["Logging full request bodies, which copies ePHI into tools that were never meant to hold it."],["Forgetting backups, exports and test copies of production data."],["Treating ePHI as a separate category from PHI. It is the same data, in electronic form."]],"related":[{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."},{"href":"/glossary/encryption-at-rest","label":"Encryption at rest","detail":"Encrypting stored data, such as databases, files and backups, so it cannot be read without the key."},{"href":"/glossary/encryption-in-transit","label":"Encryption in transit","detail":"Encrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way."},{"href":"/glossary/covered-entity","label":"Covered entity (HIPAA)","detail":"Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."},{"href":"/build/ehr","label":"Building an EHR","detail":"Clinical records, access control and integrations."},{"href":"/build/telehealth-platform","label":"Building a telehealth platform","detail":"Video visits, scheduling, records and HIPAA."}],"sources":[{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"},{"title":"45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C","checkedAt":"2026-10-25"},{"title":"45 CFR 164.312, HIPAA technical safeguards (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}