TheHIPAA Privacy Rule protects all "individually
identifiable health information" held or transmitted by a
covered entity or its business associate, in any form or
media, whether electronic, paper, or oral. The Privacy
Rule calls this information "protected health information
(PHI).