MedTech Terms
    The authoritative reference
    All terms

    PHI and ePHI

    Individually identifiable health information (PHI) and its electronic form (ePHI) - the data class HIPAA protects.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Protected Health Information (PHI) is individually identifiable health information held or transmitted by a HIPAA Covered Entity or Business Associate, in any form. Electronic PHI (ePHI) is PHI in electronic media. PHI includes the 18 HIPAA identifiers (names, dates, geographic subdivisions smaller than state, contact info, SSNs, MRNs, biometric identifiers, and more) when linked to health information.
    What the regulation says
    The HIPAA Privacy Rule governs use and disclosure of PHI; the Security Rule governs the technical/administrative/physical safeguards for ePHI. HHS OCR enforces both. De-identification under the Safe Harbor standard (removal of all 18 identifiers) or Expert Determination removes data from PHI status.

    What this means in practice

    MedTech architects should map every data field in the device and back-end against the 18 identifiers and design data flows to minimize PHI surface area. Common patterns: de-identify telemetry at source, segregate identified-data services, encrypt every PHI store, and log every PHI access.
    Common pitfalls
    • •Treating MAC addresses or device serial numbers as non-identifying - they can re-identify when linked to other data.
    • •Pseudonymizing PHI and calling it de-identified - pseudonymization is not de-identification under HIPAA.

    Frequently asked questions

    By itself, no. Combined with health information about the patient using that device, it can re-identify and become PHI.

    Primary references

    3 sources
    Link health: 2 verified 1 bot-blocked· last checked 2026-05-09
    HHS OCR·2FDA·1
    1. 1
      HHS Guidance: De-Identification of PHI
      Verified
      HHS OCRhhs.gov
    2. 2
      HHS HIPAA for Professionals
      Verified
      HHS OCRhhs.gov
    3. 3
      FDA - Cybersecurity for Medical Devices
      Bot-blocked
      FDAfda.gov

    Inline markers like [1] jump to the matching reference above.