A Spreadsheet That Cost a Hospital $3 Million

In 2018, the University of Rochester Medical Center agreed to pay $3 million to the Office for Civil Rights after unencrypted flash drives containing PHI data walked out the door. Not once — repeatedly. The drives held patient names, medication lists, and lab results. Nobody encrypted them. Nobody tracked them. And when OCR came knocking, URMC couldn't produce a risk analysis that covered portable media.

That case is a perfect illustration of what happens when an organization doesn't fully understand what PHI data actually is, where it lives, and who's touching it. I've seen this confusion play out in hospitals, dental offices, behavioral health clinics, and billing companies. The pattern is always the same: people assume PHI means "medical records" and miss everything else.

This post breaks down exactly what qualifies as PHI, the common mistakes that lead to enforcement actions, and the specific steps your organization should take to protect every piece of it.

What Exactly Is PHI Data Under HIPAA?

Protected Health Information — PHI — is any individually identifiable health information that a covered entity or business associate creates, receives, maintains, or transmits. That's the legal definition from 45 CFR Part 160. But the practical definition is broader than most people realize.

PHI data has two components that must exist together. First, there's a health element — a diagnosis, treatment, lab value, prescription, billing code, or anything describing a person's past, present, or future health condition or healthcare payment. Second, there's an identifier — something that links that health information to a specific individual.

The 18 Identifiers That Make Health Data "PHI"

HHS spells out 18 specific identifiers in the Privacy Rule. If any one of these is attached to health information, you're handling PHI data:

  • Names
  • Geographic data smaller than a state
  • Dates (except year) related to an individual — birth dates, admission dates, discharge dates, death dates
  • Phone numbers
  • Fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Vehicle identifiers and serial numbers
  • Device identifiers and serial numbers
  • Web URLs
  • IP addresses
  • Biometric identifiers (fingerprints, voiceprints)
  • Full-face photographs and comparable images
  • Any other unique identifying number, characteristic, or code

Strip all 18 identifiers and you've got de-identified data. Keep even one, and that spreadsheet, that text message, that voicemail — it's PHI.

The Mistakes I See Over and Over Again

In my experience, organizations don't get burned because they ignore PHI data entirely. They get burned because they have a narrow, outdated understanding of it. Here are the patterns I encounter most often.

Mistake #1: Forgetting That Billing Data Is PHI

A patient's name next to a CPT code is PHI. A claim with a diagnosis code and a date of birth is PHI. Your billing department handles PHI data all day long, yet I regularly walk into practices where the billing team has never completed HIPAA training. That's a violation of the workforce training requirement under 45 CFR § 164.530(b).

Mistake #2: Treating Paper Like It's Not a Risk

Electronic PHI — ePHI — dominates compliance conversations. But OCR doesn't give you a pass on paper. Printed schedules left at the front desk, patient intake forms in an unlocked filing cabinet, sign-in sheets that expose names and appointment reasons — all PHI data, all violations waiting to happen.

Mistake #3: Ignoring PHI in Everyday Communication

Nurses text patient vitals to physicians on personal phones. Front desk staff leave voicemails with test results. Care coordinators email discharge summaries to the wrong address. Every one of these involves PHI data transmission, and every one creates breach notification obligations if something goes wrong.

If your nursing staff communicates patient information throughout the day — and they do — make sure they understand what qualifies as PHI and how to handle it. Our HIPAA training course for nurses and clinical workflows covers exactly these scenarios.

Does PHI Include Information About Deceased Patients?

Yes. PHI protections extend to deceased individuals for 50 years after the date of death. I bring this up because it surprises people. Hospitals that maintain legacy records, long-term care facilities that archive old charts, and research institutions working with historical patient data — all of them are still bound by the Privacy Rule for those records.

ePHI: Where the Security Rule Takes Over

When PHI data exists in electronic form — on servers, in cloud platforms, on laptops, in email systems, on mobile devices — it becomes ePHI, and the HIPAA Security Rule kicks in with its own set of administrative, physical, and technical safeguards.

The Security Rule requires you to conduct a thorough risk analysis, implement access controls, maintain audit logs, and encrypt ePHI in transit and at rest. That last point is critical. Encryption isn't technically "required" — it's "addressable" — but if you choose not to encrypt, you need a documented, equivalent alternative. In practice, OCR treats unencrypted ePHI as a red flag.

Remember that $3 million URMC settlement? Unencrypted ePHI on portable devices, no comprehensive risk analysis. That's the playbook for a devastating enforcement action.

The $1.5 Million Question: What Happens When PHI Data Gets Exposed?

When a breach of unsecured PHI affects 500 or more individuals, OCR investigates. The breach notification rule under 45 CFR §§ 164.400-414 requires you to notify affected individuals, HHS, and in some cases the media — all within 60 days.

But the financial damage goes well beyond the notification costs. In 2023, Banner Health paid $1.25 million after a 2016 cyberattack exposed the ePHI of nearly 3 million individuals. OCR's investigation found long-running noncompliance with the Security Rule — inadequate access controls, insufficient monitoring, and a failure to conduct an enterprise-wide risk analysis.

Your exposure isn't limited to what hackers steal. It includes what your workforce accidentally sends, loses, or throws away. I've seen covered entities face corrective action plans — multi-year compliance monitoring by OCR — over a single misdirected fax containing PHI data.

How to Protect PHI Data: The Non-Negotiables

If you want to stay off OCR's enforcement page, here's what actually matters.

1. Conduct a Real Risk Analysis — and Update It

Not a checklist. Not a one-time exercise. A comprehensive, documented risk analysis that identifies every system, device, and workflow where PHI data lives. Update it annually and whenever you adopt new technology or change processes.

2. Train Your Entire Workforce

HIPAA requires training for every member of your workforce — not just clinicians, not just new hires. That includes volunteers, contractors, and anyone with access to PHI. Training must cover what PHI data is, how to handle it, and what to do when something goes wrong. Explore our full catalog of HIPAA training courses to find the right fit for each role in your organization.

3. Encrypt Everything You Can

Laptops, email, cloud storage, portable media, messaging platforms. If it holds or transmits ePHI, encrypt it. Encryption is the single most effective safeguard against a reportable breach. Under the breach notification rule, encrypted PHI that gets lost or stolen is not considered "unsecured" — meaning you may not even have a notification obligation.

4. Control Access Ruthlessly

Role-based access, unique user IDs, automatic logoff, and regular access reviews. The minimum necessary standard applies — your staff should access only the PHI data they need for their specific job function. No exceptions.

5. Have an Incident Response Plan That People Actually Know

When a breach happens — and at some point, something will happen — your team needs to know who to call, what to document, and how to contain the damage. I've investigated incidents where 72 hours passed before anyone reported a lost laptop because nobody knew the process. That delay compounds the harm and the liability.

PHI vs. PII: A Distinction That Trips People Up

Personally Identifiable Information (PII) is a broader category used in general privacy law. PHI is specific to HIPAA. The overlap is significant — a name and Social Security number can be both PII and PHI — but the difference matters. PHI data only exists in the context of healthcare: health conditions, treatment, or payment for healthcare, linked to an identifier, held by a covered entity or business associate.

If you're a health plan, healthcare provider conducting electronic transactions, or a healthcare clearinghouse — you're a covered entity. If you handle PHI on behalf of a covered entity — you're a business associate. Either way, the rules apply to you.

The Bottom Line on PHI Data

PHI data is broader than your medical record system. It lives in billing spreadsheets, voicemails, appointment schedules, text messages, and employee conversations in the elevator. It covers the living and the recently deceased. It triggers federal enforcement when mishandled.

Every dollar spent understanding, locating, and protecting PHI data is a dollar you won't spend on breach notification, OCR settlements, and reputation repair. I've worked with organizations on both sides of that equation. Trust me — the proactive side is cheaper, quieter, and infinitely less stressful.

Start with your risk analysis. Train your people. Encrypt your data. And never assume you know where all the PHI is — because in my experience, you don't. Not yet.