ePHI (electronic protected health information)
Also called electronic protected health information, EPHI.
Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.
Last updated
What it is.
45 CFR 160.103 defines electronic protected health information as PHI that is sent by or kept in electronic media. In practice that is nearly all PHI a software product touches: database records, files, backups, logs, emails and API payloads.
The HIPAA Security Rule (45 CFR Part 164 Subpart C) sets the safeguards for ePHI: administrative (risk analysis, training), physical (facility and device controls) and technical (access control, audit controls, integrity and transmission security).
Why it matters
The Security Rule is where HIPAA turns into engineering work. Knowing where ePHI lives in your system tells you which parts need access control, audit logs, encryption at rest, encryption in transit and backups that meet the rule.
In a product build
A data map of every place ePHI is stored or sent, including logs and backups, is one of the first documents a health product build should produce.
Common mistakes.
- 01
Logging full request bodies, which copies ePHI into tools that were never meant to hold it.
- 02
Forgetting backups, exports and test copies of production data.
- 03
Treating ePHI as a separate category from PHI. It is the same data, in electronic form.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
- 45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)checked 2026-10-25
- 45 CFR 164.312, HIPAA technical safeguards (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- Encryption at restEncrypting stored data, such as databases, files and backups, so it cannot be read without the key.
- Encryption in transitEncrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way.
- Covered entity (HIPAA)Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions.
