Examples of PHI: Is It PHI? 30 Data Types Answered

Examples of PHI include a patient's name, phone number, email, address, date of birth, Social Security or medical record number, IP address or photo, whenever a HIPAA covered entity or its business associate holds it with information about that person's health, care or payment for care (45 CFR 160.103; 45 CFR 164.514). The same phone number in a public phone book is not PHI, but listed with "an indication that the individual was treated at a certain clinic" it is (HHS). Curve Compliance, which signs a BAA on every plan, checks every event a healthcare website sends for PHI-like patterns and strips PHI before data reaches an ad platform.

Book a call. Curve's team will review which of these data types your website sends to Meta, Google and TikTok with you, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

The test: identifier, health link, and who holds it

• Does it identify someone? It identifies the person, or there is "a reasonable basis to believe the information can be used to identify the individual" (45 CFR 160.103). The most common ones are the 18 HIPAA identifiers.
• Is it about health, care or payment? It relates to a person's "physical or mental health or condition," "the provision of health care," or "payment for the provision of health care" (45 CFR 160.103).
• Does a covered entity or business associate hold it? HHS says "the protections of the Privacy Rule apply to information held by covered entities and their business associates" (HHS).

All three must be true. For the full legal definition, see what PHI means; for the test applied to a website, see what counts as PHI on a website.

Is it PHI? 30 data types

Each data type below is PHI only when all three tests pass. The middle column says whether 45 CFR 164.514(b)(2)(i) lists it among the identifiers Safe Harbor de-identification removes; a "No" there does not mean "not PHI."

Data type	One of the 18 Safe Harbor identifiers?	When it is PHI
Full name	Yes, (A)	With health, care or payment data, such as a clinic's patient list. A phone book name is not (HHS).
Initials	Part of a name (HHS)	HHS says a data set with "patient initials" fails Safe Harbor, so initials tied to health data stay PHI.
Phone number	Yes, (D)	When tied to a patient record, booking or call about care. See is a phone number PHI.
Fax number	Yes, (E)	Same as a phone number.
Email address	Yes, (F)	When it comes with a booking, form answer or patient record. See is an email address PHI.
Street address	Yes, (B)	With health, care or payment data, such as a patient record or booking request a covered entity holds.
City or county	Yes, (B)	The rule lists "All geographic subdivisions smaller than a State, including street address, city, county" (45 CFR 164.514).
ZIP code	Yes, (B), with a 3-digit exception	The first three digits may stay only if that area "contains more than 20,000 people"; otherwise they become 000 (45 CFR 164.514). See is a ZIP code PHI.
State	No, only units "smaller than a State" (45 CFR 164.514)	A state can stay in Safe Harbor data, but it is part of PHI in an identifiable record.
Date of birth	Yes, (C)	Every part of the date except the year. See is date of birth PHI.
Age	Yes, (C) for "all ages over 89"	Those may be grouped into "a single category of age 90 or older" (45 CFR 164.514). Younger ages are not listed but are PHI in an identifiable record.
Appointment, admission or discharge date	Yes, (C)	HHS lists "dates of appointments" among data trackers may receive (HHS).
Social Security number	Yes, (G)	HHS says even "the last four digits of a Social Security number" fail Safe Harbor (HHS).
Medical record number (MRN)	Yes, (H)	HHS lists a "medical record number" among PHI that portal trackers can reach (HHS).
Health plan member ID	Yes, (I), "Health plan beneficiary numbers"	When a plan, provider or their vendor holds it with the member's record.
Insurance details (payer, plan, group)	Only member IDs, under (I)	Tied to a patient, they relate to payment for care, so they are PHI (45 CFR 160.103).
Claim number	Not named; falls under (R)	HHS says (R) covers features "not explicitly enumerated" that "could be used to identify a particular individual" (HHS).
Account number	Yes, (J)	Billing and payment accounts at a clinic or plan.
Driver's license or other license number	Yes, (K)	A scanned ID at intake.
Vehicle ID or license plate	Yes, (L)	Rare in health records.
Device ID or advertising ID	Yes, (M)	HHS names the "device ID" and "advertising ID" a health app can collect (HHS).
Cookie IDs and ad click IDs (gclid, fbclid)	Not named; unique codes fall under (R)	Google says the GCLID "identifies the campaign along with other attributes of the click" (Google); Meta lists its click and browser IDs among "user identifiers" (Meta). Sent with a booking or form, treat them as PHI.
IP address	Yes, (O)	When tied to health, care or payment data. A June 20, 2024 court order vacated HHS's guidance on an IP address plus a visit to a public page about health conditions or providers (HHS); see are IP addresses PHI.
URL	Yes, (N)	A URL unique to one person, such as a portal link with a patient ID; any URL can also carry an email. See are UTM parameters PHI.
Full-face photo	Yes, (Q)	Before-and-after photos and intake photo uploads, once linked to a patient.
Fingerprint or voice print	Yes, (P)	HHS lists "fingerprints" among data a health app can collect (HHS).
Diagnosis or condition	No; it is the health information itself	Tied to any identifier above, it is PHI; in properly de-identified data, it is not.
Prescription or medication	No; it is the health information itself	Same as a diagnosis: health information that becomes PHI when tied to a person.
Gender or sex	No; it is demographic data	It is demographic data, part of PHI in an identifiable record. HHS cites an estimate that date of birth, sex and 5-digit ZIP code together are "unique for over 50% of residents in the United States" (HHS).
De-identified data	Not PHI	Data that meets Safe Harbor or Expert Determination "is no longer considered protected health information" (HHS).

What is not PHI

Four kinds of records are outside the definition: education records covered by FERPA, certain related records, "employment records held by a covered entity in its role as employer," and information about a person "deceased for more than 50 years" (45 CFR 160.103). De-identified data and aggregates that identify no one are not PHI: HHS says a report that "only noted the average age of health plan members" would not be PHI (HHS). Health data held by a business that is neither a covered entity nor a business associate falls outside HIPAA, though FTC breach notification provisions can apply to "vendors of personal health records" (HHS).

Website and ad-data examples

HHS says data sent to tracking vendors "might include an individual's medical record number, home or email address, or dates of appointments, as well as an individual's IP address or geographic location, device IDs, or any unique identifying code" (HHS). HHS adds that individually identifiable health information "collected on a regulated entity's website or mobile app generally is PHI, even if the individual does not have an existing relationship with the regulated entity" (HHS). Three common cases:

• A booking on a covered clinic's site. When the site sends appointment details and the visitor's IP address to a tracker, HHS says "the tracking technology vendor is a business associate, and a BAA is required" (HHS).
• A hashed email sent to an ad platform. HHS says a code "derived from a secure hash function without a secret key" "would be considered an identifying element" (HHS). See is a hashed email PHI.
• A thank-you page URL with a name or email in it. The URL now carries an identifier listed under item (A) or (F), and a URL unique to one person counts under (N) (45 CFR 164.514).

To see what your own pages send, start with the free Curve Compliance website scan, which lists the pixels and trackers on a page. Which rules apply depends on your facts, so talk to your counsel. For a second pair of eyes, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields. Contact identifiers such as emails and phone numbers are off by default on Meta, Google Ads and TikTok, and events can use neutral names. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what each platform received. See how Curve's PHI detection works.

Curve collects this data under the BAA it signs on every plan (BAA Directory entry), and Curve is SOC 2 Type II. Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 160.103; 45 CFR 164.514; HHS, guidance on de-identification of protected health information; HHS, use of online tracking technologies by HIPAA covered entities and business associates; HHS, Breach Notification Rule; HHS, fact sheet on the 42 CFR Part 2 final rule; HHS, HIPAA Security Rule NPRM; HHS, regulatory initiatives; Google Ads Help, Google Click Identifier (GCLID); Meta for Developers, customer information parameters.

Frequently Asked Questions

Can you give me an example of protected health information (PHI)?

A lab report, a hospital bill, or a clinic's booking record with a patient's name and appointment date are all PHI, because each ties a person's identity to their health, care or payment (HHS).

Is a social security number an example of PHI?

Yes, when a covered entity or business associate holds it with health, care or payment information; it is item (G) on HIPAA's identifier list (45 CFR 164.514). Even a partial number does not pass Safe Harbor (HHS).

Is a phone number considered PHI?

Yes, when it is linked to a person's health, care or payment, such as a number on a clinic's appointment list. On its own, as in a phone book, it is not (HHS). See is a phone number PHI.

What items do not contain PHI?

De-identified data, aggregate statistics that identify no one, public directory listings, FERPA education records, employment records a covered entity holds as an employer, and records about people who died more than fifty years ago (45 CFR 160.103; HHS).

Is a name by itself PHI?

Not by itself. HHS says names alone "would not necessarily be designated as PHI"; a name becomes PHI when it is listed with health, care or payment information that a covered entity or business associate holds (HHS). A name typed into a covered clinic's booking form is an example (HHS).

Are initials considered PHI?

They can be. HHS says a data set with "patient initials" would not meet the Safe Harbor standard, so health data that still carries initials is not de-identified by that method and stays PHI (HHS).

Are cookies and ad click IDs like gclid and fbclid PHI?

They can be. They are unique codes, which Safe Harbor removes under item (R), and HHS lists "any unique identifying code" among data trackers may receive (45 CFR 164.514; HHS). A click ID sent with a booking or form submission from a covered entity's site should be treated as PHI.

What is the new HIPAA rule in 2026?

There is no single new rule. For updated notices of privacy practices, HHS says "Compliance with the remaining NPP modifications is required by February 16, 2026" (HHS), and the 42 CFR Part 2 final rule has the same date (HHS). HHS's Security Rule update, issued December 27, 2024, is still a proposed rule (HHS). See the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.