I think the reasoning behind this is that credit card numbers have a very low life expectancy after they are leaked. One or two fraudulent charges, and the CC#

I think the reasoning behind this is that credit card numbers have a very low life expectancy after they are leaked. One or two fraudulent charges, and the CC# is generally cancelled. Medical records, however, usually include full personal details (address history, medical history, SSN, phone numbers, etc.) and by definition can't be changed. Therefore, should someone access this data, there is a whole range of fraud and identity theft that can be executed. Most people don't have credit monitoring services, and it's way easier to take out a fraudulent credit card and rack up charges that will never be detected (until some of the bills go through or the credit card defaults) than it is to use a legitimate one. So, it's not the medical data per se, except maybe blackmail or insurance fraud (not common), but more generic identity theft. PHI is basically someone's whole identity in a file!