What Is ePHI? Electronic PHI and the Security Rule

ePHI, electronic protected health information, is PHI that is transmitted by or maintained in electronic media, as defined in 45 CFR 160.103, and it is the information the HIPAA Security Rule protects (HHS). Form submissions, booking records and conversion data from a clinic's website are electronic, so when they identify a patient, relate to their care and are held by a covered entity or its business associate, they are ePHI. Curve Compliance signs a BAA on every plan and strips PHI before data reaches an ad platform.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

The definition

45 CFR 160.103 defines it in one line: "Electronic protected health information means information that comes within paragraphs (1)(i) or (1)(ii) of the definition of protected health information." Those paragraphs cover PHI "(i) Transmitted by electronic media" and "(ii) Maintained in electronic media." The third paragraph, PHI "Transmitted or maintained in any other form or medium," is PHI but not ePHI. Because ePHI is a subset of PHI, the PHI test comes first; see what PHI means and examples of PHI.

The same section defines electronic media as "Electronic storage material on which data is or may be recorded electronically" and "Transmission media used to exchange information already in electronic storage media." Transmission media "include, for example, the Internet, extranet or intranet, leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media" (45 CFR 160.103).

PHI vs ePHI

For identifiable health information that a covered entity or business associate holds:

Form of the information	PHI?	ePHI?	Security Rule applies?
Paper chart or printed intake form	Yes	No	No (HHS)
Spoken, such as a phone call or a front-desk conversation	Yes	No	No (HHS)
Fax or phone call where the information was not electronic just before sending	Yes	No	No (45 CFR 160.103)
EHR record, patient portal message, email or text	Yes	Yes	Yes (HHS)
Web form submission or booking record tied to care, stored in a CRM	Yes	Yes	Yes (HHS)

HHS puts the split plainly: "Unlike the Privacy and Breach Notification Rules, the Security Rule does not apply to PHI that is maintained or transmitted on paper or verbally" (HHS). The Privacy and Breach Notification Rules cover PHI in every form, electronic or not.

Examples of ePHI, and what is not ePHI

• Clinical and billing systems. Records in an EHR, a practice management system or a billing tool, plus their backups.
• Patient portals. HHS says tracking tools on logged-in pages "generally have access to PHI," such as "an individual's IP address, medical record number, home or email addresses, dates of appointments" (HHS).
• Email and texts with patients. HHS says "The Security Rule does not expressly prohibit the use of email for sending e-PHI" (HHS).
• Website data. Form submissions, booking records and CRM entries tied to a patient's care. HHS says a covered entity must ensure the ePHI "collected through its website is protected and secured in accordance with the HIPAA Security Rule" (HHS).
• Devices. Laptops, phones, USB drives and other "removable/transportable digital memory" holding any of the above (45 CFR 160.103).

Not ePHI: PHI on paper or spoken aloud; a paper fax or a phone call when the information "did not exist in electronic form immediately before the transmission" (45 CFR 160.103); and anything that is not PHI to begin with, such as de-identified data.

The Security Rule's three safeguards

Covered entities and business associates must "Ensure the confidentiality, integrity, and availability of all electronic protected health information" they create, receive, maintain or transmit (45 CFR 164.306). HHS says the rule "sets forth the administrative, physical, and technical safeguards" they must put in place (HHS).

• Administrative safeguards. Defined as "administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information" (45 CFR 164.304). They start with a risk analysis, "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI (45 CFR 164.308).
• Physical safeguards. Defined as "physical measures, policies, and procedures to protect a covered entity's or business associate's electronic information systems and related buildings and equipment" (45 CFR 164.304), such as facility access and workstation and device controls (45 CFR 164.310).
• Technical safeguards. Defined as "the technology and the policy and procedures for its use that protect electronic protected health information and control access to it" (45 CFR 164.304): access control, audit controls, integrity, authentication and transmission security (45 CFR 164.312).

Some specifications are "Required" and others "Addressable," and HHS says "The 'addressable' designation does not mean that an implementation specification is optional" (HHS). Encryption is addressable under 45 CFR 164.312.

A change is proposed. On December 27, 2024, HHS "issued a proposed rule to improve cybersecurity" by modifying the Security Rule. HHS's page, checked October 26, 2026, still describes it as a proposed rule and says "While the Department is undertaking this rulemaking, the current Security Rule remains in effect" (HHS). See the proposed Security Rule and marketing vendors and the new HIPAA rule in 2026.

Where ePHI sits in a marketing stack

• Forms. Intake, contact and booking forms that collect a name with a reason for a visit. HHS's tracking guidance covers information a visitor "types or selects" on a covered entity's site (HHS).
• CRM and booking tools. Lead and appointment records tied to care, held by a vendor on your behalf. That vendor is a business associate (next section).
• Analytics and session replay. Session replay scripts "record a user's activities (e.g., mouse movements, clicks, and typing)" (HHS), so on a form page they can capture what a patient types.
• Ad pixels and conversion APIs. When a covered clinic's site sends appointment details and the visitor's IP address to a tracking vendor, HHS says "the tracking technology vendor is a business associate, and a BAA is required" (HHS).

For the website test, data point by data point, see what counts as PHI on a website.

Vendors that store ePHI need a BAA

HHS says that when a covered entity engages a cloud service provider "to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA," and "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." The conduit exception is narrow: HHS limits it "to transmission-only services" (HHS). See what a business associate is, what a BAA is and cloud storage that signs a BAA.

To see which tools on your site receive data, start with the free Curve Compliance website scan, which lists the pixels and trackers on a page. Which rules apply depends on your facts, so talk to your counsel. For a second pair of eyes, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. See how Curve's PHI detection works.

Curve collects this data under the BAA it signs on every plan (BAA Directory entry), and Curve is SOC 2 Type II. Curve Forms hosts intake and lead forms under the same BAA, with ad attribution attached. Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 160.103; 45 CFR 164.304; 45 CFR 164.306; 45 CFR 164.308; 45 CFR 164.310; 45 CFR 164.312; HHS, summary of the HIPAA Security Rule; HHS, use of online tracking technologies by HIPAA covered entities and business associates; HHS, guidance on HIPAA and cloud computing; HHS, FAQ on sending e-PHI by email; HHS, HIPAA Security Rule NPRM.

Frequently Asked Questions

What is ePHI?

ePHI is electronic protected health information: PHI that is transmitted by or maintained in electronic media, such as an EHR record, a patient email or a stored web form submission (45 CFR 160.103). The HIPAA Security Rule applies to it.

What is the difference between PHI and e PHI?

PHI is identifiable health information in any form; ePHI is only the part that is transmitted or maintained electronically (45 CFR 160.103). The Privacy and Breach Notification Rules cover all PHI, while the Security Rule covers only ePHI (HHS).

What are examples of ePHI?

An EHR record, a patient portal message, an email or text about an appointment, a bill in a billing system, a web form submission or booking record tied to care, and any backup or device holding these. Each is PHI kept in or sent over electronic media (45 CFR 160.103).

What is not considered ePHI?

PHI on paper or spoken aloud, and a paper fax or a phone call where the information "did not exist in electronic form immediately before the transmission" (45 CFR 160.103). Data that is not PHI at all, such as de-identified data, is not ePHI either.

Does HIPAA apply to ePHI?

Yes. ePHI is PHI, so the Privacy and Breach Notification Rules apply, and the Security Rule requires covered entities and business associates to protect the "confidentiality, integrity, and availability" of all ePHI they handle (45 CFR 164.306).

What are the three safeguards for protecting e-PHI?

Administrative, physical and technical safeguards (HHS). Administrative covers risk analysis, policies and training; physical covers facilities, workstations and devices; technical covers access control, audit controls, integrity, authentication and transmission security (45 CFR 164.312).

Where can ePHI be stored?

On any electronic system, from servers and laptops to phones, removable media and the cloud, with the Security Rule's safeguards in place. HHS says a cloud service may store or process ePHI "provided the covered entity or business associate enters into a HIPAA-compliant business associate contract or agreement (BAA) with the CSP" (HHS).

What are methods for transmitting e-PHI?

Transmission media "include, for example, the Internet, extranet or intranet, leased lines, dial-up lines, private networks," plus moving removable storage media (45 CFR 160.103). For email, HHS says "The Security Rule allows for e-PHI to be sent over an electronic open network as long as it is adequately protected" (HHS).

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.