Is a Hashed Email PHI? Sending Hashed Emails to Meta

Yes, a hashed email is still PHI whenever the plain email would be, because hashing alone does not de-identify it under HIPAA. So a clinic covered by HIPAA that sends hashed patient emails to Meta or Google Ads is disclosing PHI to a company that Curve's BAA Directory lists as not signing a BAA (Meta, Google Ads). Email addresses are on HIPAA's identifier list at 45 CFR 164.514(b)(2)(i)(F), and HHS says a hash made with no secret key "would be considered an identifying element." Meta and Google both say they use hashed emails to match people to accounts. Curve Compliance sends conversions to Meta and Google Ads server-side with contact identifiers off by default, credits each one to the original ad click, and signs a BAA on every plan.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then set up server-side conversions credited to the original ad click, under a BAA on every plan. Book a call with Curve.

Hashed emails and HIPAA at a glance

What you send to an ad platform	Still an identifier under HIPAA?	Why (source)
Plain email address	Yes	The Safe Harbor list names "Electronic mail addresses" (§164.514(b)(2)(i)(F)).
SHA-256 hashed email, no secret key	Yes	HHS says "a code derived from a secure hash function without a secret key" is an identifying element, and derivatives of listed identifiers may not be disclosed under Safe Harbor (HHS guidance).
SHA-256 hashed phone number	Yes	"Telephone numbers" are listed at (D), and the same answer on derivatives applies (§164.514(b)(2)(i)(D)).
Hash made with a secret key the recipient never gets	It can be de-identified, if an expert determines so	HHS allows this under Expert Determination "provided the keys associated with such functions are not disclosed, including to the recipients of the de-identified information" (HHS guidance).
Ad click ID only, no contact details	Not named on the list. It can fall under the catch-all at (R).	(R) is "Any other unique identifying number, characteristic, or code." HHS says it covers unique features that "could be used to identify a particular individual." Neither text mentions click IDs (§164.514; HHS guidance).

An identifier is not PHI by itself. PHI "means individually identifiable health information" (45 CFR 160.103), so an email, hashed or plain, is PHI when it ties a person to health, care or payment for care and a covered entity or business associate holds it. See what counts as PHI on a website and whether IP addresses are PHI.

What HIPAA says about emails and codes made from them

HIPAA gives two ways to de-identify health information (45 CFR 164.514(b)). Under Expert Determination, a qualified expert finds that "the risk is very small" that an "anticipated recipient" could identify anyone. Under Safe Harbor, 18 kinds of identifiers, lettered (A) through (R), are removed, including "Electronic mail addresses" and "Telephone numbers."

A hash is a code made from the email. A covered entity may attach a code to de-identified data only if the code "is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual" (§164.514(c)(1)). A hashed email is derived from the email, so it does not meet that condition.

HHS guidance says so directly. It asks, "May parts or derivatives of any of the listed identifiers be disclosed consistent with the Safe Harbor Method?" and answers "No." It adds that a code from a secure hash function without a secret key, such as a salt, "would be considered an identifying element. This is because the resulting value would be susceptible to compromise by the recipient of such data" (HHS de-identification guidance, last reviewed February 3, 2025).

The keyed hash in the table is a narrow opening (HHS guidance). Ad platform matching works the other way around.

How Meta and Google use a hashed email

Meta's Business Tools Terms (effective November 3, 2025) define contact information as "information that personally identifies individuals, such as names, email addresses, and phone numbers, that we use for matching purposes only." Meta's help page on hashing says: "Meta uses this hashed information and compares it to our own hashed information to build custom audiences or more accurately determine which people took action in response to your ad." Its Conversions API documentation marks the email field "Hashing required."

Google describes the same thing. Its enhanced conversions page says hashed customer data "is then used to match your customers to Google accounts, which were signed-in to when they engaged with one of your ads." For uploaded lists, Google Ads "will compare each hashed string on your customer list with the hashed string for email address or phone number of Google accounts."

So the hash does not hide the person from the platform, which runs the same SHA-256 step on the emails it already holds and looks for the same result. That is the case HHS describes: a value "susceptible to compromise by the recipient of such data." For uploaded lists, see Customer Match for clinics.

Can a clinic send hashed emails to Meta or Google?

For a HIPAA covered clinic, HHS has addressed the plain email version. Its bulletin on online tracking technologies describes a tracker that collects "an individual's email address, or reason for seeking health care typed or selected by an individual" when someone makes an appointment on a regulated entity's webpage: "In this example, the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply." Hashing the email first does not change that.

HHS then sets the conditions: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." If either is missing, "the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor" (HHS bulletin). A cookie banner is not that authorization; see is a cookie banner enough for HIPAA.

Neither platform signs a BAA, according to Curve's BAA Directory (Meta, Google Ads). Meta's terms add a second limit: advertisers agree not to share data that "includes or is based on, directly or otherwise, health information" (Business Tools Terms, section 1.h).

HHS notes at the top of the bulletin that a federal court vacated part of it on June 20, 2024: the part about an IP address connected to a visit to a public webpage about health conditions or providers. The email example above is still in the bulletin (annotated here). And these rules reach covered entities and business associates, defined at 45 CFR 160.103 (see med spas and cash-pay telehealth).

What the FTC says about hashing

Federal Trade Commission staff say the same thing outside HIPAA. On July 24, 2024, staff in its Office of Technology published "No, hashing still doesn't make your data anonymous." It says: "Companies should not act or claim as if hashing personal information renders it anonymized." It ends: "the opacity of an identifier cannot be an excuse for improper use or disclosure."

The post cites the FTC's case against the online counseling service BetterHelp, brought under Section 5 of the FTC Act. The complaint (Docket No. C-4796, issued July 7, 2023) alleges that BetterHelp hashed email addresses before sending them to Facebook, but "the hashing was not meant to conceal the Visitors' and Users' identities from Facebook or the other recipient third parties." It alleges BetterHelp knew those third parties "were able to, and in fact would, effectively undo the hashing and reveal the email addresses" of people with accounts on their platforms.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve credits each conversion to the original ad click, including bookings made days later (conversion tracking).

Curve strips PHI before data reaches an ad platform. It checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and events can use neutral names. Event Logs show what Curve sent to each platform and what the platform accepted. Curve signs a BAA on every plan (BAA Directory entry), is SOC 2 Type II, and Curve's team does the setup; most customers are live in about a week.

How HIPAA applies to your own lists and events depends on your facts, so talk to your counsel, and book a call with Curve to see what your site sends today.

Sources, checked October 13, 2026: 45 CFR 164.514; 45 CFR 160.103; HHS de-identification guidance and online tracking bulletin; FTC staff post on hashing (July 24, 2024) and BetterHelp complaint, Docket No. C-4796; Meta Business Tools Terms, About hashing customer information and Conversions API customer information parameters; Google Ads Help About enhanced conversions and About the customer matching process; BAA Directory entries for Meta and Google Ads.

Frequently Asked Questions

Is a hashed email PHI?

Yes, whenever the plain email would be. Email addresses are a listed identifier at 45 CFR 164.514(b)(2)(i)(F), and HHS says derivatives of listed identifiers may not be disclosed under Safe Harbor, so hashing alone does not de-identify an email.

Can I send hashed emails to Meta from my clinic?

If your clinic is covered by HIPAA and the emails belong to patients or people asking about care, that discloses PHI. HHS says that takes a signed BAA and an applicable permission, or else "the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor." Curve's BAA Directory lists Meta as not signing a BAA.

Does SHA-256 hashing de-identify data under HIPAA?

Not by itself. HHS guidance says "a code derived from a secure hash function without a secret key" is an identifying element. Under Expert Determination, hashing can count only if the keys "are not disclosed, including to the recipients of the de-identified information."

Does Meta delete hashed emails after matching them?

Meta says so: hashed customer information "is deleted promptly after the match process is complete" (Meta). HHS says that is not enough for HIPAA: "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS bulletin).

Are Google enhanced conversions HIPAA compliant if the email is hashed?

Hashing does not settle it. Google says the hashed data "is then used to match your customers to Google accounts," and Curve's BAA Directory lists Google Ads as not signing a BAA. See enhanced conversions for healthcare.

What did the FTC say about hashed emails?

In a July 24, 2024 staff post, the FTC's Office of Technology wrote: "Companies should not act or claim as if hashing personal information renders it anonymized" (FTC). Its BetterHelp complaint alleges Facebook matched hashed emails to Facebook user IDs.

How can a clinic track Meta ad conversions without sending emails?

Tie each conversion to the ad click that started it. Curve Compliance sends Meta conversions server-side with contact identifiers off by default, credits each one to the original ad click, strips PHI before data reaches an ad platform, and signs a BAA on every plan.

Talk to Curve Compliance

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, set up server-side conversions with contact identifiers off by default, and sign a BAA on every plan. Book a call with Curve.