PHI vs PII: What Healthcare Marketers Need to Know

PII is information that can be used to distinguish or trace a person's identity, while PHI is health information that identifies a person and is held or sent by a HIPAA covered entity or its business associate, so every piece of PHI is also PII but most PII is not PHI (2 CFR 200.1; 45 CFR 160.103; HHS). For ad tracking, an email or IP address that is plain PII on a retail site can become PHI on a covered provider's site once it is tied to a booking, an intake form or a patient portal (HHS). Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, strips PHI before data reaches an ad platform.

Book a call. If your ad tags run on booking or intake pages, the line between PII and PHI decides what they may send. Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Book a call with Curve.

The two definitions, side by side

HIPAA's definitions section, 45 CFR 160.103, uses the term individually identifiable health information rather than PII. One federal definition of PII sits in the federal grants rules at 2 CFR 200.1: information that "can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual." The same rule says PII "is not attached to any single category of information or technology" and calls for "a case-by-case assessment of the specific risk that an individual can be identified."

	PII	PHI
Where it is defined	No single law; one federal definition is 2 CFR 200.1	45 CFR 160.103, under HIPAA
What it is	Information that can distinguish or trace a person's identity, alone or combined with other information	Individually identifiable health information, transmitted or maintained in any form or medium
Needs a tie to health?	No	Yes: to health, health care, or payment for care
Who must protect it	Depends on which law applies to the business	HIPAA covered entities and their business associates (HHS)
Clinic website example	A visitor's IP address on a careers page (HHS)	An email and a reason for visit typed into a booking form (HHS)

HHS states the overlap plainly. Identifying information alone, "such as personal names, residential addresses, or phone numbers, would not necessarily be designated as PHI." Listed with "health condition, health care provision or payment data," it is (HHS). The federal PII definition makes a similar point about public data: "Some PII is available in public sources such as telephone books, websites, and university listings" (2 CFR 200.1). PHI also covers "demographic information collected from an individual," such as age or ZIP code, when the rest of the test is met (45 CFR 160.103).

Examples from a clinic website

These examples follow HHS's tracking bulletin and assume the site belongs to a HIPAA covered entity (HHS). For the full test and a table of website data points, see what counts as PHI on a website.

• Careers or visiting hours page: PII, not PHI. HHS says a visit to a page about "job postings or visiting hours," sent with the visitor's IP address, "would not involve a disclosure of an individual's PHI" (HHS).
• Booking form: PHI. A tracker that collects "an individual's email address, or reason for seeking health care typed or selected by an individual" while they book means "the regulated entity is disclosing PHI to the tracking technology vendor" (HHS).
• Symptom checker: PHI. The same HHS example covers someone who "enters symptoms in an online tool to obtain a health analysis" (HHS).
• Patient portal sign-up or login: PHI. Credentials or registration details entered there, such as a name and email address, mean "such information meets the definition of IIHI" (HHS).
• A public page about a condition: it depends. HHS says a student researching oncology services for a term paper "would not constitute a disclosure of PHI," even if the student could be identified (HHS). HHS's other example on the same page, a patient seeking a second opinion, falls within the part a court later vacated (below).

Why URLs and IP addresses are on HIPAA's identifier list

HIPAA's de-identification rule names 18 identifiers to remove under its Safe Harbor method, and several are everyday web data: "Electronic mail addresses," "Web Universal Resource Locators (URLs)," "Internet Protocol (IP) address numbers," and "Any other unique identifying number, characteristic, or code" (45 CFR 164.514). In a retail site's logs, those are PII. On a covered provider's site, they are the identifying half of PHI, so a tag that sends the page URL and the visitor's IP address deserves a close look. All 18, quoted and mapped to website data, are in the 18 HIPAA identifiers, and URLs have their own guide: are UTM parameters PHI.

What the 2024 court ruling changed

On June 20, 2024, a federal court in Texas vacated one part of HHS's tracking bulletin. HHS's notice says the vacated part covered cases where an online technology connects "(1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers," and that "HHS is evaluating its next steps in light of that order" (HHS). So HHS's guidance no longer treats an IP address plus a view of a public condition page as PHI on that basis alone. The order did not reach HHS's examples where a visitor types details into a form, books an appointment or logs in to a portal. Curve's annotated guide to the bulletin covers the ruling in full.

What this means for your ad pixels

For PHI, HHS says covered entities "must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." Disclosures "for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures," and cookie banners "do not constitute a valid HIPAA authorization" (HHS).

So sort every field your tags send into three groups: PII with no health tie, PHI, and data that is neither. Keep PHI away from vendors that will not sign a BAA (see which ad platforms sign a BAA), send each vendor only what its job needs under the minimum necessary rule, and check when ad tracking needs a HIPAA authorization. Which group a field falls in depends on your facts, so talk to your counsel.

How Curve Compliance helps

Curve Compliance works at the point where PII turns into PHI. It replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent to each platform and what the platform accepted.

Curve collects this data under the BAA it signs on every plan (BAA Directory entry), and Curve is SOC 2 Type II. Curve Forms hosts intake and lead forms under the same BAA, with ad attribution attached, and the free website scan lists the pixels and trackers on a page. Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 2 CFR 200.1; 45 CFR 160.103; 45 CFR 164.302; 45 CFR 164.514; 16 CFR 318.1; 16 CFR 318.2; HHS, guidance on de-identification of protected health information; HHS, use of online tracking technologies by HIPAA covered entities and business associates.

Frequently Asked Questions

What is the difference between PHI and PII?

PII is any information that can be used to distinguish or trace a person's identity, while PHI is identifiable information about health, care or payment for care that a HIPAA covered entity or its business associate holds (2 CFR 200.1; 45 CFR 160.103). Every piece of PHI is also PII, but most PII is not PHI.

Is an email address PHI?

Not on its own; HHS says identifying information alone "would not necessarily be designated as PHI" (HHS). An email a covered entity collects with a booking, a symptom checker or a portal sign-up is PHI (HHS).

Is an IP address PHI?

It can be. IP addresses are on the 164.514 identifier list, and HHS treats one as PHI when it is tied to a person's health or care, such as an appointment request (HHS). See are IP addresses PHI.

Is hashed data still PHI?

Hashing alone does not de-identify it. HHS says a code "derived from a secure hash function without a secret key" is an identifying element under Safe Harbor, and that hashed values derived from PHI can be part of a de-identified data set when an expert determines the data meets the standard, "provided the keys associated with such functions are not disclosed, including to the recipients of the de-identified information" (HHS). See is a hashed email PHI.

Does HIPAA apply to a wellness brand?

Only if it is a covered entity or business associate under 45 CFR 160.103. A health app or brand outside HIPAA may fall under the FTC's Health Breach Notification Rule, which "does not apply to HIPAA-covered entities" and covers vendors of personal health records (16 CFR 318.1; 16 CFR 318.2). See med spas and cash-pay telehealth.

What is the difference between PHI and ePHI?

ePHI is PHI that is transmitted by or maintained in electronic media (45 CFR 160.103). The HIPAA Security Rule applies to it: covered entities and business associates must meet its standards "with respect to electronic protected health information" (45 CFR 164.302).

Does PHI include demographic information?

Yes, when the rest of the test is met. Individually identifiable health information includes "demographic information collected from an individual" that relates to health, care or payment and can identify the person (45 CFR 160.103).

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.