Unsecured Protected Health Information

Unsecured protected health information is PHI that has not been protected in a way that makes it unreadable, unusable, or indecipherable to unauthorized people. Under HIPAA, this often matters when evaluating whether an incident involving health information may require breach response and notification.

Protected health information is generally considered unsecured when it can be accessed, read, copied, or used by unauthorized individuals because controls such as encryption, secure deletion, access restriction, or physical protection are missing or ineffective. Examples include unencrypted files, printed records left unattended, exposed backups, or misdirected messages.

PHI is identifiable health-related information handled by organizations subject to HIPAA obligations. Unsecured PHI is a higher-risk condition where that information has not been adequately protected from unauthorized access, disclosure, or use through recognized safeguards such as encryption or secure destruction.

Encrypted PHI is usually not treated the same as unsecured PHI when the encryption is strong, properly implemented, and the keys are not exposed. If encryption is weak, misconfigured, bypassed, or the decryption key is compromised, the information may still create significant security and breach-response risk.

Examples include unencrypted patient files on a stolen laptop, printed medical records left in a public area, a spreadsheet of patient data emailed to the wrong recipient, cloud storage with overly broad access, or backup media containing identifiable health information without encryption or secure handling.

An organization should contain the incident, preserve evidence, assess what PHI was involved, determine who may have accessed it, evaluate legal and contractual notification duties, document decisions, and remediate the root cause. Response should involve privacy, security, legal, compliance, and operational stakeholders.

Healthcare organizations can reduce unsecured PHI disclosures by encrypting systems and backups, applying least-privilege access, using secure messaging and file transfer, training workforce members, monitoring access, restricting exports, securing paper records, and reviewing third-party handling of health information.

Common controls for electronic PHI include access control, multi-factor authentication, encryption at rest and in transit, audit logging, endpoint protection, vulnerability management, secure backup practices, data loss prevention, incident response procedures, and periodic review of user permissions and system configurations.

Responsibility is shared across leadership, privacy officers, security teams, IT administrators, application owners, workforce members, and service providers that handle PHI. Each group must understand its role in protecting information, reporting incidents, and following approved policies and procedures.

Information security and GRC programs should identify where PHI exists, classify it as sensitive data, define control requirements, assign ownership, monitor access, maintain evidence of safeguards, test incident response procedures, and track remediation when PHI is found to be stored, transmitted, or disposed of insecurely.