ePHI is electronic protected health information: any individually identifiable health information that is created, received, stored, or transmitted in electronic form, and that HIPAA requires covered entities and their business associates to protect. It is the digital subset of PHI, and it is what HIPAA's Security Rule governs — including data that leaks through website tracking tools.
What makes health data ePHI?
Two conditions must both be true: the data is individually identifiable (it can be tied to a specific person), and it relates to that person's health, care, or payment for care. Add "in electronic form" and PHI becomes ePHI. A lab result in a database is ePHI; the same result read aloud is PHI but not ePHI; a population statistic with every identifier stripped is neither.
The identifier does not have to be a name. HIPAA lists 18 identifier types, and the presence of any one, alongside health context, can make data ePHI:
| # | Identifier | # | Identifier |
|---|---|---|---|
| 1 | Names | 10 | Account numbers |
| 2 | Geographic data smaller than a state | 11 | Certificate/license numbers |
| 3 | Dates (birth, admission, etc.) | 12 | Vehicle identifiers |
| 4 | Phone numbers | 13 | Device identifiers and serial numbers |
| 5 | Fax numbers | 14 | Web URLs |
| 6 | Email addresses | 15 | IP addresses |
| 7 | Social Security numbers | 16 | Biometric identifiers |
| 8 | Medical record numbers | 17 | Full-face photos |
| 9 | Health plan beneficiary numbers | 18 | Any other unique identifying number or code |
Items 14–18 are the ones most people miss — and the reason web tracking is a HIPAA problem. An IP address (15), a device identifier (13), or a tracking cookie (18) collected on a page whose URL (14) reveals a condition can be ePHI, even with no name anywhere.
ePHI vs PHI vs de-identified data
| De-identified data | PHI | ePHI | |
|---|---|---|---|
| Identifiable? | No (all 18 removed, or expert determination) | Yes | Yes |
| Form | Any | Any (paper, oral, electronic) | Electronic only |
| HIPAA applies? | No | Yes (Privacy Rule) | Yes (Privacy + Security Rules) |
| Example | Aggregate condition counts | A mailed test result | A patient-portal session |
De-identification is the escape hatch: strip all 18 identifiers (or get an expert determination of low re-identification risk) and the data leaves HIPAA scope. The catch is that tracking tools do the opposite — they add identifiers to health-context data.
How ePHI leaks through websites
The modern ePHI breach is rarely a hacked database. It is a marketing tag doing its job too well. When an analytics or advertising script runs on a page about a diagnosis, a provider, or an appointment, and that script captures an IP address, a click, or a logged-in identifier, it can transmit ePHI to a vendor — Google, Meta, an ad exchange — that will not sign a Business Associate Agreement for it. That is the exact pattern behind the wave of HIPAA website-tracking enforcement since 2022.
Server-side controls cannot see it, because the transmission happens in the patient's browser, straight from the page to the third party. Detecting it requires privacy monitoring at the browser layer: watching which scripts run on health-context pages, what data each can read, and where it goes. Teams weighing vendors for this can compare cside and Feroot, the two client-side monitoring options positioned for healthcare.
The takeaway
ePHI is not just what is in your EHR — it is any electronic identifier joined to health context, including the ones tracking scripts silently collect. Protecting it under HIPAA's Security Rule means knowing what executes on every patient-facing page, which is a visibility problem before it is a policy one.
