A Receptionist Emailed a Spreadsheet — and It Cost $1.5 Million

In 2018, a staff member at Cottage Health sent an unencrypted file containing patient names, diagnoses, and Social Security numbers to a personal email address. The organization had already settled with OCR once before. This time, the settlement hit $3 million. The root cause wasn't malice. It was a fundamental failure to understand what PHI under HIPAA actually covers — and how easily it can slip out.

If you think PHI HIPAA requirements only apply to doctors and billing departments, this post is going to reframe everything. Every person in your organization who touches patient data — or even walks past it on a screen — needs to understand what protected health information is, why it matters, and what happens when it's mishandled.

What Exactly Is PHI Under HIPAA?

Protected health information, or PHI, is any individually identifiable health information that a covered entity or business associate creates, receives, stores, or transmits. That definition comes directly from the HIPAA Privacy Rule at 45 CFR §160.103.

Here's the part most people miss: the information doesn't have to include a diagnosis to be PHI. If it relates to a person's past, present, or future health condition, healthcare services, or payment for those services — and it identifies the individual or could reasonably be used to identify them — it's PHI.

That means a patient's name next to an appointment date is PHI. A billing record with a procedure code and address is PHI. Even a photograph taken in a clinical setting can qualify if the patient is identifiable.

The 18 Identifiers That Make Data PHI

HHS defines 18 specific identifiers that, when combined with health information, make that data protected. I've seen organizations memorize the list but still fail to apply it. Here are the ones that trip people up most often:

  • Names
  • Dates (birth, admission, discharge, death) — anything more specific than year
  • Phone and fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Device identifiers and serial numbers
  • Full-face photographs and comparable images
  • Biometric identifiers (fingerprints, voiceprints)
  • Any other unique identifying number, characteristic, or code

Remove all 18 identifiers according to the Safe Harbor method, and you've got de-identified data. Keep even one, and you're still handling PHI under HIPAA rules.

ePHI: The Digital Version Most Breaches Come From

When PHI lives in electronic form — on a server, in an email, on a laptop, inside an EHR — it's called ePHI. The HIPAA Security Rule applies specifically to ePHI and demands administrative, physical, and technical safeguards to protect it.

In my experience, this is where most organizations bleed. They understand paper charts need to be locked up. But they let staff access patient portals on personal devices, send ePHI through unencrypted text messages, or store spreadsheets with patient data on shared drives with no access controls.

OCR's breach portal tells the story. The vast majority of large breaches reported to HHS involve electronic records — hacking incidents, unauthorized access, and lost or stolen devices containing ePHI. You can review the data yourself on the HHS Breach Portal.

Common ePHI Mistakes I See Every Month

  • Clinicians texting patient details to colleagues on personal phones
  • Front desk staff emailing appointment reminders with diagnoses included
  • IT teams failing to encrypt portable devices that store patient data
  • Business associates accessing ePHI without a signed BAA in place

Every one of these is a PHI HIPAA violation waiting to become a breach notification headache.

PHI vs. Health Information: The Distinction That Matters

Not all health information is PHI. This is the question I get asked most often during training sessions, and it's a fair one.

Health information becomes PHI only when two conditions are met: it relates to an individual's health, treatment, or payment — and it identifies or could reasonably identify that individual. Strip the identity, and it's just data.

A dataset showing that 340 patients in a zip code received flu vaccines last year? Not PHI if no individual can be identified. A note on a whiteboard that says "Room 4 — diabetes consult — Maria Gonzalez"? That's PHI, and it's exposed to anyone walking by.

This distinction matters because your workforce makes judgment calls about PHI dozens of times a day. If they don't understand the line, they'll cross it.

The $2.15 Million Lesson From Jackson Health System

Jackson Health System in Miami agreed to a $2.15 million settlement with OCR in 2019 after multiple HIPAA failures. Among the issues: employees were accessing PHI without authorization, paper records containing PHI were found in a public area, and the organization failed to provide timely breach notifications.

What struck me about that case wasn't the dollar amount. It was the variety of failures — paper PHI left out, electronic records accessed inappropriately, and a sluggish breach notification process. It was a systemic failure to treat PHI with the gravity HIPAA demands.

This is exactly why workforce training can't be a checkbox exercise. Your staff needs to understand not just what PHI is, but how to handle it in the specific workflows they perform every shift. Our HIPAA Training for Nurses course was built for exactly this kind of clinical reality — role-specific scenarios, not generic slides.

Who Is Responsible for Protecting PHI?

Every covered entity — health plans, healthcare clearinghouses, and healthcare providers who transmit any health information electronically — bears responsibility for PHI. So does every business associate that handles PHI on their behalf.

But here's what I tell every compliance officer I work with: responsibility flows downward. The Privacy Rule requires you to train every member of your workforce. That includes employees, volunteers, trainees, and anyone else under your organization's direct control.

If a volunteer at your front desk hands a patient the wrong discharge summary, your organization owns that violation. Not the volunteer.

Training Is the Frontline Defense

OCR has made it clear in enforcement action after enforcement action: inadequate training is a correctable problem, and failing to correct it invites penalties. The HIPAA Privacy Rule at 45 CFR §164.530(b) requires training for all workforce members on policies and procedures related to PHI.

If your team hasn't completed updated training this year, start with our HIPAA Introduction Training for 2026. It covers PHI identification, handling requirements, and breach notification basics in a format designed for busy professionals.

What Happens When PHI Is Breached?

The Breach Notification Rule kicks in when unsecured PHI is accessed, used, disclosed, or acquired in a way not permitted by the Privacy Rule. Your organization must notify affected individuals, HHS, and — if 500 or more people are affected — the media.

Timelines are strict. Individual notifications must go out within 60 days of discovery. Breaches affecting 500 or more individuals in a single state or jurisdiction require media notification in that area.

Failing to notify on time is itself a violation. OCR has pursued enforcement actions based solely on delayed breach notifications, independent of the underlying breach.

Quick-Reference: Is It PHI?

Use this test every time you're unsure:

  • Step 1: Does the information relate to a person's health condition, treatment, or payment for care?
  • Step 2: Does it identify the individual, or could it reasonably be used to identify them?
  • Step 3: Was it created or received by a covered entity or business associate?

If all three answers are yes, it's PHI — and every PHI HIPAA safeguard applies.

Your Next Step Isn't Optional

PHI is everywhere in your organization — in your EHR, your email, your fax machine, your hallway conversations. The organizations that avoid six- and seven-figure penalties aren't the ones with the biggest IT budgets. They're the ones whose workforce can identify PHI on sight and knows exactly what to do with it.

If you're not confident every person in your organization meets that standard, explore our full HIPAA training catalog and close the gap before OCR finds it for you.