PHI

{
  "id": "MLC-T-CYB-003119",
  "term": "PHI",
  "field": "Cybersecurity",
  "definition": "1. Individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information in: (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 USC. 1232g; (ii) Records described at 20 USC. 1232g(a)(4)(B)(iv); and (iii) Employment records held by a covered entity in its role as employer.\n\n2. Individually identifiable health information:\n(1) Except as provided in paragraph (2) of this definition, that is:\n(i) Transmitted by electronic media;\n(ii) Maintained in electronic media; or\n(iii) Transmitted or maintained in any other form or medium.\n(2) Protected health information excludes individually identifiable health information:\n(i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;\n(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);\n(iii) In employment records held by a covered entity in its role as employer; and\n(iv) Regarding a person who has been deceased for more than 50 years.\n\n3. individually identifiable health information (1) Except as provided in paragraph (2) of this definition, that is (i) Transmitted by electronic media; Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information in (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and Employment records held by a covered entity in its role as employer.",
  "expansions": [
    "Personal Health Information",
    "protected health information"
  ],
  "references": [
    "NIST SP 800-188 from HIPAA Privacy Rule",
    "NIST SP 800-66r2 from HIPAA Security Rule (§160.103)",
    "NISTIR 8053 from 45 C.F.R., Sec. 164.514(e)2",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/phi/"
}