What Is PHI, and Why Does It Matter for File Conversion?
Protected Health Information (PHI) is any health information tied to an identifiable individual — patient names, diagnosis codes, treatment notes, lab results, insurance IDs, dates of service. The HIPAA Privacy and Security Rules govern how covered entities and their business associates handle PHI.
If you're a healthcare worker and you convert a document containing PHI — a patient report, a lab PDF, a referral letter — you've just processed that information under HIPAA rules.
The Business Associate Problem
HIPAA requires that any third party who handles PHI on your behalf sign a Business Associate Agreement (BAA). When you upload a patient document to a free online converter, that converter becomes a business associate. But free online converters almost never offer BAAs.
Using a non-BAA converter to process PHI is a HIPAA violation. The penalties range from $100 to $50,000 per violation depending on culpability, with a maximum of $1.9 million per violation category per year.
Compliant Options for PDF-to-Word, CSV, or Excel Conversion
Option 1: Local browser-based conversion (no upload)
Browser-based converters like HarborConvert process files locally — the file never leaves your device. There is no third-party server involved, which means there is no business associate relationship to manage. This is the simplest compliant option for basic format conversions.
Option 2: HIPAA-compliant cloud services
Some enterprise file conversion services (Adobe Acrobat for business, certain Microsoft 365 features) operate under BAAs and meet HIPAA requirements. These are appropriate for workflows that require cloud storage or collaboration.
Option 3: Desktop software
Installed software like LibreOffice, Microsoft Office, or Adobe Acrobat handles conversion locally. No network required.
Practical Guidance for Common Scenarios
Converting a lab report PDF to CSV: Use a local converter. HarborConvert's PDF-to-CSV converter works entirely in your browser.
Merging patient intake forms: Use a local PDF merger — no upload needed.
Extracting data tables from a clinical trial report: Use HarborConvert's PDF-to-Excel converter locally, or copy-paste into Excel manually for maximum control.
Converting medical imaging files (DICOM): Specialized DICOM viewers and converters are required — these are outside the scope of general-purpose converters.
The Bottom Line
If the document contains patient information, don't upload it to a free online tool that hasn't signed a BAA. Browser-based local conversion is the safest and simplest compliant path for everyday document format conversions.