Is an Email Address PHI? When Email Counts Under HIPAA

It depends on who holds the email address and what it is linked to: an email address is PHI when a HIPAA covered entity or its business associate holds it with information about a person's health, care or payment, because "Electronic mail addresses" are item (F) on HIPAA's identifier list in 45 CFR 164.514(b)(2)(i). A lead's email in a clinic's booking form is usually PHI, and HHS uses that very case in its tracking guidance (HHS). Curve Compliance, which signs a BAA on every plan, keeps contact identifiers off by default on Meta, Google Ads and TikTok and strips PHI before data reaches an ad platform.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, emails in URLs included, then set up server-side conversions with PHI removed before anything is sent to an ad platform. Book a call with Curve.

The answer and the rule

HIPAA's definition in 45 CFR 160.103 has two halves: information about a person's health, care or payment for care, and information that "identifies the individual" or could reasonably be used to. An email address is the identifying half. HHS says identifying information alone "would not necessarily be designated as PHI," but it is PHI once "listed with health condition, health care provision or payment data, such as an indication that the individual was treated at a certain clinic" (HHS).

HHS's tracking bulletin covers the email case directly. Tracking technologies "might collect an individual's email address, or reason for seeking health care typed or selected by an individual" when someone books an appointment, and in that example HHS says "the regulated entity is disclosing PHI to the tracking technology vendor" (HHS). See the 18 HIPAA identifiers, examples of PHI for 30 other data types, and the spokes on phone numbers, dates of birth and ZIP codes.

When an email address is not PHI

• In a public listing. HHS says identifying information from "a publicly accessible data source" is not PHI, because it is not tied to health data (HHS).
• Held outside HIPAA. The rules apply to health plans, health care clearinghouses, health care providers that conduct standard electronic transactions, and business associates (45 CFR 160.102). An email list kept by any other business is not PHI.
• In staff and job records. PHI excludes "employment records held by a covered entity in its role as employer" (45 CFR 160.103), and HHS says a visit to a hospital page about "job postings or visiting hours" with identifying information "would not involve a disclosure of an individual's PHI" (HHS).
• The clinic's own addresses. An address such as info@ belongs to the business. The Safe Harbor list covers identifiers "of the individual" (45 CFR 164.514).

Where email addresses show up on a website and in ad data

Where it shows up	What it looks like	Is it PHI?
Contact, booking or intake form	Typed into an email field	Yes, once a covered clinic holds it with the request (HHS).
Thank-you or confirmation URL	?email=name%40example.com in the query string	Yes when it comes from a booking flow, and every tag on the page sees it: the browser sends "the URL of the page you're visiting" (Google).
Patient portal	The login or account email	Yes. HHS says trackers on logged-in pages "generally have access to PHI," including "home or email addresses" (HHS).
CRM or EHR record	The email on a lead or patient profile	Yes, when listed with care or payment data (HHS).
Free-text message box	An email typed into a note	Yes. A listed identifier "must be removed regardless of its location in a record if it is recognizable as an identifier" (HHS).
Ad platform match key	Meta's "em" parameter, marked "Hashing required."	Meta calls email addresses "Contact Information" that it uses "for matching purposes only" (Meta).

HHS says regulated entities "are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI to tracking vendors (HHS). As HHS notes on that page, a court vacated one part of the guidance on June 20, 2024, about IP addresses and visits to unauthenticated public pages; see are IP addresses PHI. Form events need care: see form tracking without PHI and are UTM parameters PHI.

Hashed emails and ad platforms

Ad platforms take emails as hashed match keys. Hashing does not take an email out of HIPAA; is a hashed email PHI walks through HHS's guidance and what Meta and Google Ads receive. On Curve, contact identifiers are off by default on Meta, Google Ads and TikTok.

Emailing patients

HHS says "The Privacy Rule allows covered health care providers to communicate electronically, such as through e-mail, with their patients, provided they apply reasonable safeguards when doing so," such as "checking the e-mail address for accuracy before sending" (HHS FAQ 570). The Security Rule "does not expressly prohibit the use of email for sending e-PHI," but requires access, integrity and transmission safeguards (HHS FAQ 2006). For which email services sign a BAA, see HIPAA compliant email providers and email marketing platforms by BAA status. Marketing emails raise separate questions; see marketing authorization. Which rules apply to your emails depends on your facts, so talk to your counsel.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and each platform receives only a fixed list of fields. Contact identifiers, email included, are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as emails in URLs, condition names and form answers, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what each platform accepted.

Curve Forms hosts intake and lead forms under the BAA Curve signs on every plan, with ad attribution attached, and form answers are never sent to an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.514; 45 CFR 160.103; 45 CFR 160.102; 2 CFR 200.1; HHS, de-identification guidance; HHS, online tracking bulletin; HHS FAQ 570; HHS FAQ 2006; HHS, 42 CFR Part 2 fact sheet; HHS, Security Rule NPRM; HHS, regulatory initiatives; Google, partner sites; Meta, customer information parameters.

Frequently Asked Questions

Is an email address PHI?

It is when a HIPAA covered entity or business associate holds it with information about a person's health, care or payment, because "Electronic mail addresses" are on HIPAA's identifier list (45 CFR 164.514). With no health information attached, it "would not necessarily be designated as PHI" (HHS).

What emails are HIPAA compliant?

HIPAA sets rules for how covered entities use email rather than approving email services. HHS says providers may email patients with "reasonable safeguards," and that "The Security Rule allows for e-PHI to be sent over an electronic open network as long as it is adequately protected" (HHS FAQ 570; HHS FAQ 2006). For which providers sign a BAA, see HIPAA compliant email providers.

Is an email address considered personally identifiable information?

Generally, yes. The federal grant rules at 2 CFR 200.1 define PII as "information that can be used to distinguish or trace an individual's identity," and Meta describes email addresses as information "that personally identifies individuals" (Meta). See PHI vs PII.

Can someone get my personal information from my email address?

It can be used to link records about you. Meta calls email addresses information "that personally identifies individuals" and uses them "for matching purposes only" (Meta). Under HIPAA, HHS says "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS).

Can you send PII via email?

Yes, with care. For PHI, HHS says covered providers may email patients "provided they apply reasonable safeguards when doing so," and if a patient emails first, the provider "can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable" (HHS FAQ 570). The Security Rule "does not expressly prohibit the use of email for sending e-PHI" (HHS FAQ 2006).

What is the new HIPAA rule in 2026?

There is no single new rule. Compliance with updated notice of privacy practices requirements and with the 42 CFR Part 2 rule was required by February 16, 2026 (HHS; HHS). The Security Rule update HHS issued on December 27, 2024 is still a proposed rule (HHS); see the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.