Physical safeguards for PHI include keeping paper records in locked cabinets, storing PHI out of sight from unauthorized individuals, and providing physical access control to records via: a security authority, PIN pads, ID swipes, and more. While ePHI is stored digitally, physical safeguards still apply.

Where is the best place to store electronic protected health information ePHI?

We recommend that medical records and PHI stored in hallways that are accessible by unauthorized individuals should be in locked cabinets. No open shelves in a patient or research subject area. No open shelves in a hallway that allows access to individuals not authorized to access those medical records and PHI.

Who is responsible for PHI and ePHI?

HIPAA Covered Entities (CEs) under the Act, such as health plans, healthcare clearinghouses, and healthcare providers, are responsible for safeguarding PHI and ePHI. HIPAA also covers business associates (BAs) and other vendors.

What data is ePHI?

Under HIPAA, any information that can be used to identify a patient is considered Protected Health Information (PHI). PHI in electronic form — such as a digital copy of a medical report — is electronic PHI, or ePHI.

What does ePHI mean?

Electronic protected health information (ePHI) is protected health information (PHI) that is produced, saved, transferred or received in an electronic form. In the United States, ePHI management is covered under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule.

What items contain ePHI?

• Personal computers with internal hard drives used at work, home, or while traveling.
• External portable hard drives.
• Magnetic tape.
• Removable storage devices, including USB drives, CDs, DVDs, and SD cards.
• Smartphones and PDAs.

How do you store paper medical records?

Ensure that all of your paper medical records are protected from basic environmental hazards. This includes: storing them away from air conditioners, heathers, and sources of water; and ensuring that they are stored at temperatures between 65 and 70° F at 55% relative humidity.

Is a fax considered ePHI?

Your typical phone call or fax may contain PHI, so it is still subject to the HIPAA Privacy Rule, but it is not considered to be a transmission on electronic media, so it will not be ePHI, and it will therefore not be subject to the HIPAA Security Rule.

What is the difference between PHI and ePHI?

Protected Health Information Definition PHI relates to physical records, while ePHI is any PHI that is created, stored, transmitted, or received electronically. PHI only relates to information on patients or health plan members.

Is Completed health insurance claim PHI or ePHI?

Patient information is, by nature, sensitive, and health insurance claims are common PHI (protected health information).

Article first time published on

How do I safeguard ePHI?

1. Password-Protect Microsoft Word Files.
2. Encryption Using a “Public-Private Key” Option.
3. Encryption Using “Symmetric Key” Option.
4. Secure Web Sites.
5. Virtual Private Networks (VPNs)

What are examples of IIHI?

Common individual identifiers include name, address, and social security number, but may also include date of birth, Zip Code, or county location.

How do you safeguard PII PHI and ePHI?

1. Encrypt everything. Encryption is critical. …
2. Assess your risk. Conduct a complete risk assessment of all the elements of your ecosystem that store, process, or transfer electronic PHI (ePHI). …
3. Training is fundamental. …
4. Be vigilant and ready to act. …
5. Read business associate agreements and find partnerships you trust.

What safeguard limits access to locations where PHI is kept and maintained?

Technical safeguards are defined in HIPAA that address access controls, data in motion, and data at rest requirements. A covered entity must implement technical policies and procedures for computing systems that maintain PHI data to restrict access to only those persons that have been granted access rights.

Is a doctor's name considered PHI?

Examples of PHI include: Billing information from a doctor or clinic. Email to a doctor’s office about a medication or prescription. … Any record containing both a person’s name and name of that person’s medical provider.

How do you store medical records at home?

Use a filing cabinet, 3-ring binder, or desktop divider with individual folders. Store files on a computer, where you can scan and save documents or type up notes from an appointment. Store records online using an e-health tool; certain online records tools may be accessed, with permission, by doctors or family members.

Can medical records be stored electronically?

All protected health information, whether it’s oral, on paper, or electronic, is protected by HIPAA. HIPAA also requires that only information that is necessary in conducting business should be shared or used.

Can medical records be stored in a storage unit?

While laws can vary by country, California state law requires records to be accessible for up to 7 years. Custodians of medical records can store physical copies in a secure storage facility or scan the documents and store them electronically using an EMR system.

What is an OCR audit?

What is an OCR Audit? A HIPAA audit is a protocol that the OCR follows which assesses the policies, controls, and processes that covered entities or business associates are utilizing in order to comply with HIPAA and protect PHI and ePHI.

What is IIHI?

Individually Identifiable Health Information (IIHI)

Is a mailing address considered PHI?

And as we’ve learned, even names or email addresses become PHI when coupled with a health condition. Covered entities must take reasonable steps to protect PHI sent via email all the way to the recipient’s inbox.

Is age considered PHI?

Any dates (except years) that are directly related to an individual, including birthday, date of admission or discharge, date of death, or the exact age of individuals older than 89.

Is it permissible to store PHI on portable media?

It is permissible to store PHI on portable media such as a flash drive as long as the media doesn’t leave your work environment. PHI can ONLY be given out after obtaining written authorization.

Can PHI be oral?

According to the HIPAA Privacy Rule, forms of PHI can be oral, written, or electronic. PHI is protected in the sense that it is forbidden to use or disclose except in narrowly authorized circumstances.

How long after death is PHI protected?

The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual.

What happens if PHI is not safeguarded?

If PHI security is compromised in a healthcare data breach, the notification process is essential. However, the HIPAA breach notification rule states that when unsecured PHI is compromised, then covered entities and their business associates need to notify potentially affected parties.

Which standard is for safeguarding PHI specifically in ePHI?

SectionStandard (R) = Required (A) = Addressable164.310(c)Workstation Security (R) Implement policies and procedures to ensure that all members of the workforce have appropriate access to ePHI and to prevent workforce members who do not have access from obtaining access to ePHI.

What should be done before taking a workstation that contains ePHI out of service?

Portable workstations/devices are to be locked when not in use or if accessible by an unauthorized person. Any device that contains ePHI must be encrypted before leaving the facility.

What does PHI stand for?

PHI stands for Protected Health Information. The HIPAA Privacy Rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information.

What is the best location to post a notice of privacy practices?

Make the latest notice (i.e., the one that reflects any changes in privacy policies) available at the provider’s office or facility for individuals to request to take with them, and post it in a clear and prominent location at the facility.

When was Hitech signed?

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, was signed into law on February 17, 2009, to promote the adoption and meaningful use of health information technology.