18 HIPAA Identifiers: How Each Shows Up in Website Data

The 18 HIPAA identifiers are the items 45 CFR 164.514(b)(2)(i) says must be removed to de-identify health information under the Safe Harbor method: names, geographic units smaller than a state, dates tied to a person (other than the year), phone and fax numbers, email addresses, Social Security, medical record, health plan, account and license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full face photos, and any other unique identifying number, characteristic or code (45 CFR 164.514; HHS). On a healthcare website, URLs and IP addresses travel with every page view a tag reports, and several more arrive through forms (Google). Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Book a call. Curve's team will review which of these identifiers your website sends to Meta, Google and TikTok with you, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

What the 18 identifiers are for

The list comes from HIPAA's de-identification standard. HHS describes "two methods that can be used to satisfy the Privacy Rule's de-identification standard: Expert Determination and Safe Harbor" (HHS). Safe Harbor means removing every listed identifier "of the individual or of relatives, employers, or household members of the individual," and the covered entity has no "actual knowledge" that what remains could identify someone (45 CFR 164.514(b)(2)). Data that meets the standard "is no longer considered protected health information" (HHS).

The list is a de-identification checklist, not the definition of PHI. Under 45 CFR 160.103, PHI is individually identifiable information about a person's health, care or payment for care that a HIPAA covered entity or business associate transmits or maintains, so an identifier becomes PHI when it is tied to that kind of information; what counts as PHI on a website covers the full test, a data-point table and the AHA v. Becerra ruling. A federal court vacated one part of HHS's tracking bulletin in June 2024, on an IP address plus a visit to a public page about a condition; see the annotated bulletin (HHS).

All 18 identifiers, quoted, and where each shows up

The middle column quotes 45 CFR 164.514(b)(2)(i) word for word.

Item	The rule's words	Where it shows up on a website or in ad data
(A)	"Names"	Contact, booking and intake form fields; patient portal sign-up pages.
(B)	"All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census" (conditions below)	Address and ZIP code fields; the "geographic location" HHS says trackers may collect (HHS).
(C)	"All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older"	Date of birth fields, and appointment dates on booking pages; HHS names "dates of appointments" among data trackers may receive (HHS).
(D)	"Telephone numbers"	Phone fields, and callers' numbers in call tracking records.
(E)	"Fax numbers"	Rare on marketing pages; some records request forms ask for one.
(F)	"Electronic mail addresses"	Form fields, newsletter sign-ups and thank-you page URLs that carry an email.
(G)	"Social security numbers"	Intake, insurance or payment plan forms that ask for one.
(H)	"Medical record numbers"	Patient portal pages and links; HHS lists a "medical record number" among data a tracker may receive (HHS).
(I)	"Health plan beneficiary numbers"	Insurance verification forms that ask for a member ID.
(J)	"Account numbers"	Billing and online payment pages.
(K)	"Certificate/license numbers"	Photo ID uploads at intake, such as a driver's license.
(L)	"Vehicle identifiers and serial numbers, including license plate numbers"	Seldom on a clinic site, but still on the list.
(M)	"Device identifiers and serial numbers"	Device IDs and advertising IDs in mobile apps, both named in HHS's tracking bulletin (HHS).
(N)	"Web Universal Resource Locators (URLs)"	URLs unique to one person, such as a portal link with a patient or appointment ID in it, or a page URL whose query string carries a name, an email or a one-person code. The rule lists identifiers "of the individual," so a plain page URL such as /services/dermatology is not one by itself, though it can supply the health half when sent with an identifier. See are UTM parameters PHI.
(O)	"Internet Protocol (IP) address numbers"	Part of every request a visitor's browser makes to a third-party script. See are IP addresses PHI.
(P)	"Biometric identifiers, including finger and voice prints"	Rare on a marketing site. Check any call tool that creates voice prints, for example to verify callers.
(Q)	"Full face photographic images and any comparable images"	Before-and-after photos, photo uploads on intake forms and profile pictures.
(R)	"Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section"	Cookie IDs a tag sets, click IDs an ad platform adds to the landing URL, and other unique codes; HHS lists "any unique identifying code" among data a tracker may receive (HHS).

Three details in the rule matter for website data (45 CFR 164.514). For ZIP codes, the first three digits may stay only if "The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people," and smaller areas must be changed to 000. For ages, the rule allows the oldest ages to be grouped into one top category instead of removed. For (R), a covered entity may keep its own re-identification code only if the code "is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual," and the covered entity "does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification."

Three groups: sent automatically, typed in, rarely seen

• Sent with every page view. IP addresses (O), and page URLs, which count under (N) when they are unique to one person or carry a person's details. Google says that on a site using its ad or analytics services, "your web browser automatically sends certain information to Google. This includes the URL of the page you're visiting and your IP address" (Google). Cookie and click IDs that tags set can fall under (R).
• Typed or selected by visitors. Names (A), addresses and ZIP codes (B), dates of birth and appointment dates (C), phone numbers (D), emails (F), member IDs (I) and photo uploads (Q). HHS's booking example covers a tracker that collects "an individual's email address, or reason for seeking health care typed or selected by an individual" (HHS).
• Rarely seen on marketing pages. Items (E), (G), (H) outside the portal, (J), (K), (L), (M) outside apps and (P). Still check intake, billing and portal pages.

Removing the 18 is not the whole test

• Actual knowledge. HHS says "actual knowledge means clear and direct knowledge that the remaining information could be used, either alone or in combination with other information, to identify an individual who is a subject of the information" (HHS).
• Free text counts. The standard "makes no distinction between data entered into standardized fields and information entered as free text," so an email typed into a message box still counts (HHS).
• Hashing is not removal. HHS says a code "derived from a secure hash function without a secret key" "would be considered an identifying element" (HHS). See is a hashed email PHI.
• Remove them before a vendor without a BAA gets them. HHS says "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS).
• The other route. Expert Determination needs a qualified expert who finds "the risk is very small" that an anticipated recipient could identify anyone (45 CFR 164.514(b)(1)). See de-identified vs anonymized data.

Check what your own site sends

Start with the free Curve Compliance website scan, which lists the pixels and trackers on a page. Then check booking, intake and contact forms, thank-you pages, the portal login and any symptom checker, and note which identifiers leave each page and who receives them. See also PHI vs PII, the minimum necessary rule and removing the Meta pixel. Which rules apply to your site depends on your facts, so talk to your counsel. For a second pair of eyes, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. See how Curve's PHI detection works.

Curve collects this data under the BAA it signs on every plan (BAA Directory entry), and Curve is SOC 2 Type II. Curve Forms hosts intake and lead forms under the same BAA, with ad attribution attached. Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.514; 45 CFR 160.103; HHS, guidance on de-identification of protected health information; HHS, use of online tracking technologies by HIPAA covered entities and business associates; Google, how Google uses information from sites or apps that use its services.

Frequently Asked Questions

What are the 18 HIPAA identifiers?

They are the identifiers 45 CFR 164.514(b)(2)(i) lists for Safe Harbor de-identification: names; geographic units smaller than a state; dates tied to a person, except year; phone and fax numbers; email addresses; Social Security, medical record, health plan beneficiary, account and certificate or license numbers; vehicle and device identifiers; URLs; IP addresses; biometric identifiers; full face photos; and any other unique identifying number, characteristic or code. Removing all of them, with no actual knowledge that the rest could identify someone, is one of HIPAA's two de-identification methods.

Is an IP address one of the 18 HIPAA identifiers?

Yes, item (O): "Internet Protocol (IP) address numbers" (45 CFR 164.514). Whether a given IP address is PHI depends on what it is tied to; see are IP addresses PHI.

Is an email address a HIPAA identifier?

Yes, item (F). HHS says identifying information alone "would not necessarily be designated as PHI," but listed with health, care or payment information it is (HHS). For hashing, see is a hashed email PHI.

Are URLs HIPAA identifiers?

Yes, item (N): "Web Universal Resource Locators (URLs)" (45 CFR 164.514). The list covers identifiers "of the individual," so a URL counts when it is unique to one person; any URL can also carry other identifiers, such as an email, or health details in its path or query string; see are UTM parameters PHI.

Is a ZIP code a HIPAA identifier?

Yes, under item (B). A full ZIP code must be removed for Safe Harbor; the first three digits may stay only when the three-digit area passes the rule's Census population test, and smaller areas become 000 (45 CFR 164.514).

Does removing the 18 identifiers make data de-identified?

Only if you also have no actual knowledge that what is left could identify someone (45 CFR 164.514(b)(2)(ii)). For tracking, HHS adds that a vendor's promise to strip PHI after it receives the data is not enough, so the data has to be de-identified before it reaches any vendor that has not signed a BAA (HHS).

Is every HIPAA identifier PHI?

No. HHS says identifying information alone "would not necessarily be designated as PHI"; it becomes PHI when held with health, care or payment information (HHS). See what counts as PHI on a website.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.