When trying to figure out, what does PHI stand for, you may come across ePHI. The term stands for electronic protected health information. It refers to any information that HIPAA-covered entities store or transfer electronically. These records could include electronic patient records or a digital invoice for care.

What are examples of ePHI?

  • Name.
  • Address (including subdivisions smaller than state such as street address, city, county, or zip code)
  • Any dates (except years) that are directly related to an individual, including birthday, date of admission or discharge, date of death, or the exact age of individuals older than 89.

What is the difference between PHI and ePHI?

Under HIPAA, any information that can be used to identify a patient is considered Protected Health Information (PHI). PHI in electronic form — such as a digital copy of a medical report — is electronic PHI, or ePHI. … Anything related to health, treatment or billing that could identify a patient is PHI.

Is ePHI a phone number?

It is critical to note that the CFR definition that exempts standard phone calls and faxes from being ePHI applies only to their transmission and does not comment on their storage. Because of this, if you are storing voicemails or faxes electronically, these will certainly qualify as ePHI.

What is not ePHI?

ePHI is only considered “protected information” when, 1) it is maintained by a HIPAA-covered entity or business associate, and 2) it can identify a specific individual. That means that health information stored in school or employment records is not ePHI, nor is the professional information of medical staff.

Where ePHI is stored?

ePHI is simply PHI stored electronically on a hard drive, server, thumb drive, or other devices.

What is ePHI in Hipaa?

Electronic protected health information (ePHI) is protected health information (PHI) that is produced, saved, transferred or received in an electronic form. In the United States, ePHI management is covered under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule.

Is gender a PHI?

Health information such as diagnoses, treatment information, medical test results, and prescription information are considered protected health information under HIPAA, as are national identification numbers and demographic information such as birth dates, gender, ethnicity, and contact and emergency contact …

Is voicemail an ePHI?

Keeping information in digital form comes with many advantages. For medical practices, however, adopting Voice Over Internet Protocol (VOIP) means that voicemails are now electronic. If you leave patient information on one of these voicemails, it’s now electronic protected health information (ePHI).

How long after death is PHI protected?

The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual.

Article first time published on

How do I safeguard ePHI?

  1. Password-Protect Microsoft Word Files.
  2. Encryption Using a “Public-Private Key” Option.
  3. Encryption Using “Symmetric Key” Option.
  4. Secure Web Sites.
  5. Virtual Private Networks (VPNs)

Who is responsible for ePHI?

The HIPAA Security Rule stipulates the person designated the role of HIPAA Security Officer must implement policies and procedures to prevent, detect, contain, and correct breaches of ePHI.

What are examples of IIHI?

Common individual identifiers include name, address, and social security number, but may also include date of birth, Zip Code, or county location.

What are the 3 rules of Hipaa?

Broadly speaking, the HIPAA Security Rule requires implementation of three types of safeguards: 1) administrative, 2) physical, and 3) technical.

Is an insurance card considered PHI?

(1) PHI consists of spoken information, physical records, or electronic records. … Additionally, standard identifiers such as patient names, Social Security numbers, Driver’s license numbers, insurance details, and birth dates are also considered PHI when linked with health information.

What is IIHI?

Individually Identifiable Health Information (IIHI)

How do you safeguard PII PHI and ePHI?

  1. Encrypt everything. Encryption is critical. …
  2. Assess your risk. Conduct a complete risk assessment of all the elements of your ecosystem that store, process, or transfer electronic PHI (ePHI). …
  3. Training is fundamental. …
  4. Be vigilant and ready to act. …
  5. Read business associate agreements and find partnerships you trust.

What practice provides the greatest protection of ePHI?

Physical safeguards for PHI include keeping paper records in locked cabinets, storing PHI out of sight from unauthorized individuals, and providing physical access control to records via: a security authority, PIN pads, ID swipes, and more. While ePHI is stored digitally, physical safeguards still apply.

When should your practice promote HIPAA awareness?

HIPAA training should ideally be provided before any employee is given access to PHI. Training should cover the allowable uses and disclosures of PHI, patient privacy, data security, job-specific information, internal policies covering privacy & security, and HIPAA best practices.

How can PHI be transmitted?

Emails including PHI can’t be transmitted unless the email is encrypted using either a third party program or encryption with 3DES, AES or similar algorithms. If the PHI is in the body text, the message must be encrypted, and if it’s part of an attach- ment, the attachment can be encrypted instead.

Is Vonage HIPAA compliant?

Above and beyond with best-in-class PCI & HIPAA compliance For many of our products, Vonage has achieved HITRUST CSF certification, the most widely adopted security framework in the U.S. for the healthcare industry.

Does VoIP need to be HIPAA compliant?

VoIP providers need to be HIPAA compliant because they could potentially record and store ePHI. Features like call recording or voicemail can end up being a HIPAA violation if they are not adequately encrypted. VoIP providers that store ePHI are considered business associates.

Is a phone call HIPAA compliant?

For a phone call to be HIPAA compliant, covered entities must state their name and contact information before addressing the purpose of their call. … Patients cannot be charged for phone calls or text messages and calls can only be made to the wireless phone number the patient provided.

Is a doctor's name considered PHI?

Examples of PHI include: Billing information from a doctor or clinic. Email to a doctor’s office about a medication or prescription. … Any record containing both a person’s name and name of that person’s medical provider.

Is age a PHI?

Examples of PHI include: Name. Address (including subdivisions smaller than state such as street address, city, county, or zip code) Any dates (except years) that are directly related to an individual, including birthday, date of admission or discharge, date of death, or the exact age of individuals older than 89.

Is last name only considered PHI?

Names, addresses and phone numbers are NOT considered PHI, unless that information is listed with a medical condition, health care provision, payment data or something that states that they were seen at a particular clinic.

Can you release deceased PHI?

It is possible for the release of PHI not permitted by HIPAA. That requires written authorization from a personal representative of the decedent. The representative needs the authorization to act for the decedent under State law. This includes people such as an executor of the decedent’s estate.

Can nurses call family members?

Yes. The HIPAA Privacy Rule, at 45 CFR 164.510(b), permits covered entities to notify, or assist in the notification of, family members, personal representatives, or other persons responsible for the care of the patient, of the patient’s location, general condition, or death.

Can a hospital tell you if a patient died?

A hospital may not disclose information regarding the date, time, or cause of death. … No other information may be provided without individual authorization. In the case of a deceased patient, authorization must be obtained from a personal representative of the deceased.

Which standard is for safeguarding of PHI specifically in ePHI?

Question 14 – Privacy Standards are: Standards for safeguarding PHI specifically in electronic format (ePHI)

What should be done before taking a workstation that contains ePHI out of service?

Portable workstations/devices are to be locked when not in use or if accessible by an unauthorized person. Any device that contains ePHI must be encrypted before leaving the facility.