A real lesson, in plain English.

You work in a place that holds some of the most personal information people own. Names, diagnoses, addresses, phone numbers, the reason someone walked in this morning.

The federal Privacy Rule is the law that says how that information is handled. It does not just apply to the doctors and the owners. It applies to you.

In the next ten minutes we will walk through what that means, in plain language. At the end you sign a record that says you did it.

PHI stands for Protected Health Information. The definition is wide. It is anything that ties a person to their care, or to who pays for their care.

Examples you handle every day: a name on an appointment book, a voicemail about a refill, a sticky note with a phone number, a chart, an x-ray, an entry in the billing system.

Electronic PHI, or ePHI, is the same thing on a screen or in a database. The rule for the day is simple. When you are not sure if something is PHI, treat it as PHI.

Minimum necessary is the working rule. Open only what your current task requires.

Reading the full chart when you only need a phone number is a violation. Discussing a patient by name in a hallway when a quieter spot exists is a violation. A paper sign-in sheet that lists the reason for each patient's visit is a violation, even if no one points it out.

The rule is not a barrier to good work. It is the small habit that, repeated, makes the practice defensible.