Is a ZIP Code PHI? Addresses and Location Under HIPAA

It depends on how precise the location is and what it is linked to: a street address, city, county or full ZIP code is PHI when a HIPAA covered entity or its business associate holds it with information about a person's health, care or payment, because 45 CFR 164.514(b)(2)(i)(B) lists "All geographic subdivisions smaller than a State" as identifiers. The first three digits of a ZIP code may stay in de-identified data only where that three-digit area holds more than 20,000 people, and a state on its own is not an identifier, though any location in a patient's record is part of the PHI (45 CFR 160.103). Curve Compliance, which signs a BAA on every plan, lets clinics screen leads by service area with a state answer in Curve Forms, without sending form answers to ad platforms.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, location fields included, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

The rule: addresses, ZIP codes and the 3-digit exception

Item (B) of the Safe Harbor list in 45 CFR 164.514(b)(2)(i) reads: "All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census," on two conditions: "The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people," and "The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000." So a patient's address is a PHI identifier: street address is the first example in (B).

HHS's de-identification guidance lists the three-digit areas that had 20,000 or fewer people in the 2000 Census, which must be shown as 000: 036, 059, 063, 102, 203, 556, 692, 790, 821, 823, 830, 831, 878, 879, 884, 890 and 893. HHS adds that covered entities "should not, however, rely upon this listing or the one found in the August 14, 2002 regulation if more current data has been published" (HHS).

An identifier is not PHI by itself. HHS says "Identifying information alone, such as personal names, residential addresses, or phone numbers, would not necessarily be designated as PHI," but the same details listed with care or payment data are PHI (HHS). See the 18 HIPAA identifiers, examples of PHI, and the spokes on phone numbers, email addresses and dates of birth.

Addresses and location on a website and in ad data

Location data	Where it shows up	Identifier under Safe Harbor?
Street address	Intake, insurance and shipping forms	Yes, the first example in item (B) (45 CFR 164.514).
City or county	Forms, and Meta's "ct" (City) match key (Meta)	Yes, smaller than a state (45 CFR 164.514).
Full five-digit ZIP code	Forms and ZIP lookups, and Meta's "zp" key, where Meta says to "Use only the first 5 digits for U.S. zip codes" (Meta)	Yes (45 CFR 164.514).
First three ZIP digits	De-identified reports	Allowed only if the area holds more than 20,000 people; otherwise 000 (45 CFR 164.514).
State	Service-area questions, and Meta's "st" (State) key (Meta)	No. The list covers units "smaller than a State" (45 CFR 164.514).
Location from an IP address	Every request a browser makes to a third-party tag	In some cases. HHS says IIHI can include, "in some circumstances IP address or geographic location" (HHS), and Google says it may use the IP address "to identify your general location" (Google).

Location in ads and analytics: targeting vs patient data

Targeting an area is not the same as sending patient data. Google Ads lets advertisers "Target your ads to people in, regularly in, or who've shown interest in geographic locations relevant to where you do business" (Google Ads Help); that is a campaign setting, not a list of patients' addresses. The risk is location data that leaves the site with health context. HHS draws the line at the page: a visit to a page about "job postings or visiting hours" along with a user's "geographic location" is not a PHI disclosure, while tracking on a booking or symptom-checker page may reach PHI (HHS).

HHS says regulated entities "are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI to tracking vendors. As HHS notes on that page, a court vacated one part of the guidance on June 20, 2024, about IP addresses and visits to unauthenticated public pages (HHS). See what counts as PHI on a website and are IP addresses PHI. Which rules apply to your site depends on your facts, so talk to your counsel.

How Curve Compliance helps

Curve Forms hosts intake and lead forms under the BAA Curve signs on every plan. It can screen people out by service area, for example with a state answer, each outcome with its own end screen, and screened-out submissions send no conversion to ad platforms, so the platforms learn from eligible leads. Form answers are never sent to an ad platform.

Across the site, Curve Compliance replaces browser ad pixels with one script and sends each platform only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what each platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.514; 45 CFR 160.103; 2 CFR 200.1; HHS, de-identification guidance; HHS, online tracking bulletin; HHS, 42 CFR Part 2 fact sheet; HHS, Security Rule NPRM; HHS, regulatory initiatives; Google Ads Help, geographic targeting; Google, partner sites; Meta, customer information parameters.

Frequently Asked Questions

Is a ZIP code PHI?

A full ZIP code is PHI when a HIPAA covered entity or business associate holds it with information about a person's health, care or payment, because "All geographic subdivisions smaller than a State" are on HIPAA's identifier list (45 CFR 164.514). Only the first three digits may stay in de-identified data, and only where that area holds more than 20,000 people.

Is zip code alone considered pii?

Often not on its own. The federal grant rules at 2 CFR 200.1 say PII "requires a case-by-case assessment of the specific risk that an individual can be identified," and a ZIP code usually covers many people. Combined with other details, it can identify someone.

Does ZIP code count as pii?

It can. The same definition says "Non-PII can become PII whenever additional information is made publicly available, in any medium and from any source, that could be used to identify an individual when combined with other available information" (2 CFR 200.1). Under HIPAA, a full ZIP code is an identifier either way (45 CFR 164.514).

Is your address part of HIPAA?

Yes. A street address is the first example in item (B) of the identifier list (45 CFR 164.514), and HHS says "residential addresses" become PHI when listed with health, care or payment data (HHS).

What things are not considered PHI?

De-identified information, which "is not individually identifiable health information" (45 CFR 164.514(a)); FERPA education records, "employment records held by a covered entity in its role as employer," and records of a person "deceased for more than 50 years" (45 CFR 160.103); and identifying details with no health link, such as a phone book listing (HHS).

What is considered PHI or pii?

PHI is HIPAA's term for "individually identifiable health information" transmitted or maintained in any form (45 CFR 160.103). PII is broader and not tied to health: the federal definition covers "information that can be used to distinguish or trace an individual's identity" (2 CFR 200.1). See PHI vs PII.

Do names count as PHI?

Yes, when tied to health information: "Names" are item (A) on the list (45 CFR 164.514). For de-identification, HHS says only patients' names and those of their relatives, employers and household members must go: "There is no explicit requirement to remove the names of providers or workforce members" (HHS).

What is the new HIPAA rule in 2026?

There is no single new rule. Compliance with updated notice of privacy practices requirements and with the 42 CFR Part 2 rule was required by February 16, 2026 (HHS; HHS). The Security Rule update HHS issued on December 27, 2024 is still a proposed rule (HHS); see the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, screens form leads by service area in Curve Forms and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.