Protected health information (PHI) / HIPAA
In one sentence
Health data protected by the HIPAA law, relevant to medical practices and any business handling patient information.
PHI is individually identifiable health information. Businesses that handle it (providers, and their 'business associates') must meet the HIPAA Security Rule's safeguards. Cyber applications ask about HIPAA when your industry touches health data.
Why it's on your cyber insurance application
Healthcare-adjacent applicants get extra scrutiny; HIPAA documentation overlaps with cyber readiness.
What this looks like in practice
If HIPAA applies to you, most of what a cyber application wants already exists somewhere: the risk analysis, the written policies, the business associate agreements. The gaps tend to be the technical specifics carriers now name, like EDR on every machine and a restore test recent enough to be credible. Start by finding the documents you already have. One detail worth checking early: your business associate agreements. Carriers and regulators both ask about them, and the vendors most often missing one are the small ones, like the transcription service or the answering service.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Where this comes up by trade
Some trades get asked about this harder than others, usually because a rule or a claim pattern already points at it. These pages have that detail.
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.