PHI (protected health information) is individually identifiable health information held or transmitted by a healthcare organization or its business associates, protected under HIPAA. It includes medical records, diagnoses, treatments, and identifiers tied to a person's health, and it is a prime target in ransomware attacks.
What PHI is
Protected health information, almost always abbreviated PHI, is the category of sensitive data at the center of healthcare privacy law in the United States. Under HIPAA, PHI is individually identifiable health information: any information about a person's health status, care, or payment for care that can be linked to that specific individual. It covers far more than just diagnoses. Medical records, test results, treatment plans, prescriptions, billing information, and the identifiers that tie them to a person, name, address, dates, medical record numbers, and more, are all PHI when held by a covered healthcare organization or its business associates.
When this information is stored or transmitted electronically, it is often called ePHI, electronic protected health information, which is the form most relevant to cybersecurity. The HIPAA Security Rule specifically governs how ePHI must be protected. Understanding what counts as PHI matters because the law's obligations, and the consequences of a breach, attach specifically to this category of data.
Why PHI is such a valuable target
PHI is among the most valuable data an attacker can steal, which is a major reason healthcare is so heavily targeted by ransomware. Unlike a credit-card number, which can be cancelled the moment fraud is detected, the information in a medical record is permanent and deeply personal: a person's diagnoses, history, and identifiers cannot be reissued. This makes stolen PHI useful for a wide range of fraud, from identity theft and insurance fraud to targeted extortion of individuals, and it commands high prices on criminal markets precisely because it is so rich and so durable.
This value is what makes PHI central to the double-extortion model of modern ransomware. Attackers steal PHI before encrypting systems, knowing that the threat to leak deeply sensitive medical data gives them powerful leverage over a hospital, independent of whether the hospital can restore from backups. For the organization, a leak of PHI is not just a privacy harm to patients but a serious legal and regulatory event, which raises the stakes of every attack.
PHI and the HIPAA breach question
The protection of PHI is exactly why a ransomware attack on a healthcare organization is such a consequential compliance event. As discussed in the context of the HIPAA breach question, US guidance presumes that when ransomware encrypts ePHI, a reportable breach has occurred, unless the organization can demonstrate a low probability that the PHI was actually compromised. Because modern attacks exfiltrate PHI as part of double extortion, that low-probability determination is often difficult to support honestly, and the default outcome is a reportable breach with notification obligations and potential penalties.
This means that protecting PHI is not only a privacy duty but the thing that determines an organization's exposure after an attack. The ability to show precisely what PHI was and was not accessed, through detailed, tamper-proof records, is what allows a defensible breach determination rather than a worst-case assumption. The same visibility that helps protect PHI during an attack is what the organization needs to meet its obligations after one.
How PHI should be protected
Protecting PHI requires the full range of HIPAA Security Rule safeguards, administrative, physical, and technical, working together, but a few technical controls are especially relevant to the ransomware threat. Encryption protects PHI at rest and in transit, so that even if data is stolen it is far less useful to the attacker, which directly blunts the data-theft half of a double-extortion attack. Strong access controls and least privilege ensure that only those who need PHI can reach it, limiting how much a compromised account can expose. Detailed audit logging records exactly who accessed what, which is both a deterrent and the evidence needed after an incident. And the ability to detect and contain an attack before it can exfiltrate PHI in bulk is what stops a breach from completing in the first place.
For a hospital, the practical reality is that PHI lives throughout a vast, connected environment, in the electronic health record, in imaging and lab systems, and flowing across the thousands of connected medical devices that make up so much of the attack surface. Protecting it therefore depends not only on securing the obvious databases but on covering that whole environment, including the agentless devices that conventional tools cannot see. A defense that watches for the bulk movement of PHI, contains an intrusion before it can steal it, and keeps an immutable record of exactly what was touched is what turns PHI from an attacker's easy prize into something genuinely defended. This overview describes how the rules generally work and is not legal advice; organizations should consult their own compliance and legal teams.
See also
Sources
- HHS: HIPAA Security Rule
- HHS OCR: Fact Sheet — Ransomware and HIPAA
- HHS: HIPAA Breach Notification Rule
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.