ePHI is protected health information in electronic form. It is the only category the HIPAA Security Rule applies to, which makes it the engineering team’s problem.
The short answer
ePHI stands for electronic protected health information: any PHI that is created, received, stored or transmitted in electronic form. Paper charts and spoken conversations are PHI but not ePHI. The distinction matters because the Privacy Rule covers all PHI in any form, while the Security Rule with its technical, physical and administrative safeguards applies specifically to ePHI.
For a software company the practical consequence is simple. Almost everything you touch is ePHI, and almost every Security Rule obligation lands on your infrastructure.
On this page
Where ePHI sits inside PHI
Where ePHI actually lives
The production database is the obvious place. The rest is where audits find problems.
| Location | Why it gets missed |
|---|---|
| Application and access logs | Written automatically, rarely reviewed, often retained far longer than the data itself |
| Database backups and snapshots | Copied to buckets that inherit different permissions from the primary |
| Support tickets and shared inboxes | Patients paste details in freely, and the help desk is rarely in scope documents |
| Chat tools and screenshots | An engineer pastes a record into a channel to debug it, and it stays there |
| Local machines and downloads | A CSV export for analysis lands in a downloads folder and is never removed |
| Non-production environments | Staging seeded from a production dump, with weaker access control |
Scope is defined by where the data is, not where you meant it to be
An inventory of ePHI locations is the first deliverable of a Security Rule risk analysis. You cannot protect a copy you have not found, and investigators will ask specifically about backups, logs and test data.
What holding ePHI obliges you to do
Three safeguard families
Administrative, physical and technical controls, each with its own standards.
A documented risk analysis
Required, not optional. It drives which addressable specifications you implement and how.
Agreements down the chain
Every vendor that touches ePHI needs a BAA, including your subcontractors.
Where teams lose track of it
| Pattern | Fix |
|---|---|
| Logs capturing request bodies containing patient records | Redact at the logging layer, not after the fact |
| Production data copied into staging for realistic testing | Synthetic or de-identified fixtures instead |
| Analytics or monitoring vendors receiving identifiers | Confirm coverage under a BAA, or stop sending the field |
| Old backups outside the retention policy | Enforce lifecycle expiry on the bucket, not by memory |
How Osto secures ePHI
The Security Rule asks for controls that are ordinary engineering practice done properly. Osto runs them: authentication and access control, encryption at rest and in transit, audit logging and monitoring, file access DLP, endpoint control and cloud posture management that flags a backup bucket left open. Evidence maps to the HIPAA safeguards in the same platform.
Free security assessment
Every copy of ePHI, protected the same way
Databases, backups, logs and laptops. Osto secures the places ePHI actually lives, not just the ones on the diagram.
Get a free security assessment Book a platform walkthroughEncryption, access and logging · Cloud posture included · One platform, everything
Frequently asked questions
What does ePHI stand for?
Electronic protected health information. It is PHI that is created, received, maintained or transmitted in electronic form, and it is the category the HIPAA Security Rule governs.
What is the difference between PHI and ePHI?
PHI covers health information in any form, including paper and speech. ePHI is the electronic subset. The Privacy Rule applies to all PHI; the Security Rule applies only to ePHI.
Are application logs ePHI?
They are if they contain identifiers alongside health context, which request logs and error traces frequently do. Logs are in scope for the Security Rule and need the same access control and retention discipline as the database.
Does ePHI have to be encrypted?
Encryption is an addressable specification rather than a flat requirement. You must implement it or document why an equivalent alternative is reasonable. In practice, encrypting ePHI is the expected answer and unencrypted data drives most breach penalties.
Is ePHI in a cloud provider still your responsibility?
Yes. The provider is a business associate and needs a BAA, but you remain accountable for configuration, access control and monitoring of your own environment.