Under the HIPAA Privacy Rule, protected health information includes information held or transmitted by a covered entity or its business associate in which form?

• A. Paper form only
• B. Oral form only
• C. Any form or media
• D. Electronic form only

Answer: (C)

Under the HIPAA Privacy Rule, protected health information covers information held or transmitted by a covered entity or its business associate in any form or medium. The rule expects privacy protections to apply no matter how the data is stored or shared—on paper, spoken aloud, or in electronic formats. This means PHI can exist as a written chart, a spoken bedside discussion, a digital record, an email, a fax, a USB drive, or any other medium, as long as it can identify the individual and relates to health care or payment for health care. The broad phrasing ensures that privacy protections follow the information across all formats, not just one.