Under regulations implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA), individually identifiable health information that is transmitted or maintained in electronic, written, or oral form (45 C.F.R. § 160.103). PHI does not include employment records held by an employer. For more information, see Practice Note, HIPAA Privacy Rule and HIPAA Privacy, Security, and Breach Notification Toolkit.