Electronic health information (EHI)
Electronic health information (EHI) is the category of data the federal information blocking rule protects. Under 45 CFR 171.102 it means electronic protected health information — to the extent that information would be included in a designated record set — regardless of whether the records are held by or for a covered entity, and excluding psychotherapy notes and information compiled for litigation. Because a designated record set includes billing records, a billing operation's electronic claim and payment data can be EHI.
Updated
Electronic health information (EHI) is the object the information blocking rule reaches. The rule's definition (45 CFR 171.102) builds it from HIPAA's own terms: EHI is electronic protected health information, as defined in 45 CFR 160.103, to the extent that it would be included in a designated record set as defined in 45 CFR 164.501.
Two features of the definition matter. First, it is tied to the designated record set — the group of records used to make decisions about individuals — which by regulation includes a provider's medical and billing records, so EHI is not limited to the clinical chart. Second, it applies regardless of whether the records are used or maintained by or for a covered entity, so EHI can exist outside the set of actors HIPAA itself regulates.
In practice
For a billing operation, the practical consequence is that electronic claim data, remittances, statements, and the payment information a practice holds about a patient can be EHI — the same billing records the HIPAA right of access reaches. A practice that interferes with the access, exchange, or use of that electronic information can implicate the information blocking rule, not only the Privacy Rule.
The definition excludes two categories: psychotherapy notes (as defined in 45 CFR 164.501), and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. Everything else in the designated record set that is held electronically is within scope.
Commonly confused with
- Protected health information (PHI): PHI is HIPAA's broad category — individually identifiable health information in any form (oral, paper, or electronic). EHI is narrower and defined for the information blocking rule: the electronic subset of PHI that would sit in a designated record set. EHI also reaches records regardless of whether a covered entity holds them, so its actor scope is not identical to HIPAA's.
- Designated record set: A designated record set is the group of records a practice uses to make decisions about individuals — including medical and billing records. EHI is the electronic protected health information within that set; the record set is the container, EHI is the electronic content the information blocking rule protects.