Are IP Addresses PHI Under HIPAA? What the Rules Say

It depends on what the IP address is connected to and who holds it: an IP address is one of the 18 identifiers listed in HIPAA's de-identification rule (45 CFR 164.514(b)(2)(i)(O)), and it is PHI only when a covered entity or business associate holds it together with information about a person's health, care or payment for care. Being on that list does not make it PHI by itself. In June 2024 a federal court vacated one part of HHS's guidance on IP addresses, for public web pages only (AHA v. Becerra). Curve Compliance sends ad conversions server-side in place of browser pixels, strips PHI before data reaches an ad platform, and signs a BAA on every plan.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA. Book a call with Curve.

What HIPAA says about IP addresses

The Privacy Rule names IP addresses directly. 45 CFR 164.514(b)(2) lists the identifiers, (A) through (R), that must be removed before health information counts as de-identified. Item (O) is "Internet Protocol (IP) address numbers" and nothing more. HHS calls this the "Safe Harbor" method (HHS de-identification guidance).

The list does not say every IP address is PHI. The same HHS guidance says: "The relationship with health information is fundamental. Identifying information alone, such as personal names, residential addresses, or phone numbers, would not necessarily be designated as PHI."

When an IP address becomes PHI: the three-part test

45 CFR 160.103 defines PHI as "individually identifiable health information" in any form, with a few listed exclusions. Information is individually identifiable health information when three things are true:

1. Who has it. A "health care provider, health plan, employer, or health care clearinghouse" created or received it, and HIPAA protects it when a covered entity or business associate holds it.
2. What it is about. It relates to a person's health or condition, "the provision of health care to an individual" or payment for that care.
3. Whether it points to a person. It "identifies the individual" or there is "a reasonable basis to believe the information can be used to identify the individual."

An IP address goes to the third part. The first two decide whether it is PHI, and HHS reads the second broadly. Its bulletin on online tracking says individually identifiable health information, collected on a regulated entity's website, "generally is PHI, even if the individual does not have an existing relationship with the regulated entity" and even without specific treatment or billing details. For every other website data point, see what counts as PHI on a website.

IP address scenarios: PHI or not?

Each row but the last assumes a covered entity's website, such as a clinic's.

IP address plus	Where	Is it PHI?	Source
A visit to a job postings or visiting hours page	Public page	No. HHS says this "would not involve a disclosure of an individual's PHI" to the vendor.	HHS bulletin
A visit to a page about a specific condition or provider	Public page	Not on that basis alone. The court vacated this "Proscribed Combination" on June 20, 2024.	AHA v. Becerra
An appointment request	Booking page or form	Yes, per HHS. A tracking vendor that receives both "is a business associate, and a BAA is required."	HHS bulletin
Activity behind a login	Patient portal or telehealth platform	Generally yes. HHS lists "an individual's IP address" among the PHI that tracking there may reach.	HHS bulletin
A conversion event, such as a booked appointment	Sent to an ad platform	Yes, per HHS's appointment example above, when the event shows the person booked or asked for care.	HHS bulletin
Nothing else, on a shared computer	A public library, for example	HHS says the IP address alone "may not be PHI" there, but combined with what a user enters it "may be PHI."	HHS bulletin, note 21
Health details a person enters	A business HIPAA does not regulate	Not PHI. HHS says that in general Privacy Rule protections "apply to information held by covered entities and their business associates." Other laws can still apply.	HHS guidance

Not sure HIPAA covers your business? See does HIPAA apply to med spas and does HIPAA apply to cash-pay telehealth.

What AHA v. Becerra changed

HHS published its bulletin on online tracking in December 2022 and revised it on March 18, 2024. Hospital groups sued over one position in it, which the court called the "Proscribed Combination" (opinion). HHS's notice on the bulletin describes it: "circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers." That means a page anyone can open without logging in.

On June 20, 2024, Judge Mark Pittman of the U.S. District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra, No. 4:23-cv-01110-P. The order "DECLARES that the Proscribed Combination, as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL" and "ORDERS that the Proscribed Combination be VACATED." It denied a permanent injunction (court docket). The reason: a website cannot know why someone opened a public page, and "HIPAA doesn't mandate clairvoyance" in the court's words.

What the ruling did not touch

Footnote 8 of the opinion says the vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." So the rest of the HHS bulletin reads as before: logged-in pages, appointment forms and symptom checkers, portal login pages, apps, BAAs and cookie banners. Curve's annotated guide to the bulletin goes through it passage by passage.

The government filed a notice of appeal on August 19, 2024. The Fifth Circuit dismissed the appeal on September 4, 2024, on the government's own motion, so no appeals court reviewed the order (court docket). As of October 13, 2026, the notice on the bulletin still says "HHS is evaluating its next steps in light of that order."

Two things stay open. The bulletin's public-page examples still appear below the notice. And the order covers HIPAA only: the bulletin says "other law may apply" where HIPAA does not, and state law can treat an IP address as personal data. Washington's My Health My Data Act, which has its own rules on who it covers, treats data associated with a persistent unique identifier, such as "an IP address," as personal information (RCW 19.373.010; see Curve's MHMDA checklist).

Why this matters for ads

A browser pixel has the visitor's browser send a request straight to the ad platform, and that request arrives with the visitor's IP address. Meta says the Meta Pixel can collect HTTP header data, which "may include data like IP addresses, information about the web browser, page location, document, referrer and person using the website" (Meta for Developers). Google says of sites that use its advertising services: "your web browser automatically sends certain information to Google. This includes the URL of the page you're visiting and your IP address."

On a booking, intake or portal page, the IP address travels with information about care. In HHS's example of an appointment made through a clinic website, the site "might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor." That vendor is then a business associate and needs a BAA (HHS bulletin). Curve's BAA Directory lists Meta and Google Ads as not signing one.

The HHS bulletin also says disclosing PHI to tracking vendors "for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures." A cookie banner is not that authorization (is a cookie banner enough for HIPAA), and hashed emails raise the same question (is a hashed email PHI).

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script. Your site's events go to Curve under the BAA Curve signs on every plan, and conversions go on to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side, from Curve's servers. Each of those platforms receives only a fixed list of fields. The visitor's IP address is off by default on all five, and events can use neutral names.

Curve strips PHI before data reaches an ad platform. It checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and flags them so they can be stopped at the source. Event Logs show what Curve sent to each platform and what the platform accepted.

Run the free Curve Compliance scanner to list the pixels and trackers on a page. Curve's team does the setup, and most customers are live in about a week. For how these rules apply to your own site, talk to your counsel, and book a call with Curve to see your setup.

Sources, checked October 13, 2026: 45 CFR 164.514; 45 CFR 160.103; HHS online tracking bulletin; HHS de-identification guidance; AHA v. Becerra, opinion and order and docket; Meta Pixel documentation; Google, sites that use its services; RCW 19.373.010.

Frequently Asked Questions

Are IP addresses PHI under HIPAA?

It depends on what the IP address is connected to and who holds it. It is a listed identifier (45 CFR 164.514(b)(2)), and it is PHI only when a covered entity or business associate holds it together with information about a person's health, care or payment for care.

Is an IP address one of the 18 HIPAA identifiers?

Yes. 45 CFR 164.514(b)(2)(i)(O) lists "Internet Protocol (IP) address numbers" among the identifiers to remove under the Safe Harbor method of de-identification. That makes it an identifier, not PHI on its own.

Did AHA v. Becerra say IP addresses are not PHI?

No. On June 20, 2024, the court vacated one HHS position: that an IP address plus a visit to a public page about specific health conditions or providers triggers HIPAA (opinion). Logged-in pages, appointment forms and apps were not part of the ruling.

Did HHS appeal AHA v. Becerra?

The government filed a notice of appeal on August 19, 2024, and the Fifth Circuit dismissed it on September 4, 2024, on the government's own motion (court docket). The HHS bulletin still says "HHS is evaluating its next steps in light of that order."

Is an IP address PHI on a patient portal or an appointment form?

Generally yes. The HHS bulletin says tracking on logged-in pages "generally have access to PHI" and names "an individual's IP address" as an example. For an appointment made through a clinic website, it says the tracking vendor "is a business associate, and a BAA is required."

Does the Meta Pixel send a visitor's IP address to Meta?

Meta says the Meta Pixel can collect HTTP header data, which "may include data like IP addresses" (Meta for Developers). Curve Compliance replaces the pixel with one script and sends Meta conversions server-side from Curve's servers, with a fixed list of fields.

Does shortening or hashing an IP address de-identify it under HIPAA?

Not under the Safe Harbor method, because a shortened or hashed IP address is a part or derivative of a listed identifier. HHS guidance asks "May parts or derivatives of any of the listed identifiers be disclosed consistent with the Safe Harbor Method?" and answers "No." For emails, see our hashed email guide.

Talk to Curve Compliance

Book a call. See what your pixels send to ad platforms today, and how the same conversions look sent server-side under a BAA. Book a call with Curve.