Protected health information means individually identifiable health information:
(1) Except as provided in paragraph (2) of this definition, that is:
- Transmitted by electronic media;
- Maintained in electronic media; or
- Transmitted or maintained in any other form or medium.
(2) Protected health information excludes individually identifiable health information:
- In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;
- In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);
- In employment records held by a covered entity in its role as employer; and
- Regarding a person who has been deceased for more than 50 years.
Source: U.S. Department of Health and Human Services, Office for Civil Rights. HIPAA Administrative Simplification. 3.26.2013. Retrieved from: https://www.hhs.gov/sites/default/files/hipaa-simplification-201303.pdf Page 16.