The HIPAA Privacy Rule protects the privacy of individually identifiable health information, called protected health information (PHI), as explained in the Privacy Rule. The Security Rule protects a subset of information covered by the Privacy Rule, which is all individually identifiable health information a provider creates, receives, maintains, or transmits in electronic form. The Security Rule calls this information “electronically protected health information” (e-PHI). The Security Rule does not apply to PHI transmitted orally or in writing.