Which form of PHI does the HIPAA Security Rule specifically require safeguards for?

Which form of PHI does the HIPAA Security Rule specifically require safeguards for?

• A. PHI stored on paper.
• B. PHI used for public health reporting.
• C. PHI in transit as plain text.
• D. Electronic PHI (ePHI)

Answer: (D)

The key idea is that the HIPAA Security Rule targets data that exists in electronic form. It requires a set of safeguards—administrative, physical, and technical—to protect electronic protected health information wherever it is created, stored, processed, or transmitted. Because ePHI is exposed to risks from cyber threats, accidental exposure, and interception during transmission, the Security Rule focuses on implementing measures like access controls, audit trails, data integrity checks, and transmission security (including encryption where appropriate). Paper PHI isn’t covered by these electronic safeguards in the same way, though it remains protected by other HIPAA provisions and facility-level privacy measures. When PHI is in transit electronically, it must be safeguarded as ePHI.

The key idea is that the HIPAA Security Rule targets data that exists in electronic form. It requires a set of safeguards—administrative, physical, and technical—to protect electronic protected health information wherever it is created, stored, processed, or transmitted. Because ePHI is exposed to risks from cyber threats, accidental exposure, and interception during transmission, the Security Rule focuses on implementing measures like access controls, audit trails, data integrity checks, and transmission security (including encryption where appropriate). Paper PHI isn’t covered by these electronic safeguards in the same way, though it remains protected by other HIPAA provisions and facility-level privacy measures. When PHI is in transit electronically, it must be safeguarded as ePHI.