What Counts as PHI on a Website? HIPAA Rules Explained

PHI on a website is information that can identify a person and relates to their health, their care or payment for care, when a HIPAA covered entity or its business associate collects, stores or sends it. That usually means appointment and intake form answers, an email or phone number tied to a reason for visit, and anything behind a patient portal login. A visit to a public page with no tie to the visitor's health is not PHI. Curve Compliance sends ad conversions server-side, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then set up server-side conversions under a BAA on every plan. Book a call with Curve.

The test for PHI, in plain words

Under 45 CFR 160.103, protected health information "means individually identifiable health information" sent or kept in any form. Information qualifies when it passes two tests.

1. It is about health, care or payment. In the rule's words, it "Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual."
2. It points to a person. It "identifies the individual," or there is "a reasonable basis to believe the information can be used to identify the individual."

It also matters who holds it. HHS's de-identification guidance says the Privacy Rule protects most such information "held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral." Whether your business is a covered entity is its own question: see our guides for med spas and cash-pay telehealth.

Both halves must be present. HHS writes: "Identifying information alone, such as personal names, residential addresses, or phone numbers, would not necessarily be designated as PHI." But "If such information was listed with health condition, health care provision or payment data, such as an indication that the individual was treated at a certain clinic, then this information would be PHI."

The 18 identifiers, and the ones a website produces

45 CFR 164.514(b)(2)(i) lists 18 kinds of identifier, lettered (A) to (R). Removing all of them, with no actual knowledge that what is left could identify someone, is one of two ways the rule accepts for de-identifying health information. A website routinely produces these: "Names", "Telephone numbers", "Electronic mail addresses", "Device identifiers and serial numbers", "Web Universal Resource Locators (URLs)", "Internet Protocol (IP) address numbers", and the catch-all, "Any other unique identifying number, characteristic, or code".

The list is a de-identification checklist, not the definition of PHI. An identifier is PHI only when it is tied to information about a person's health, care or payment, and that can be as little as the fact that they are a patient of a certain clinic.

Website data points: when each one is PHI

This table assumes the website belongs to a HIPAA covered entity.

Website data point	When it is PHI, and where the rule says so
Contact or appointment form answers	When contact details come with a reason for visit, symptoms or an appointment request. The HHS bulletin's example is a tracker collecting "an individual's email address, or reason for seeking health care typed or selected by an individual" during booking: "the regulated entity is disclosing PHI to the tracking technology vendor."
A URL or page title that names a condition	Not on its own. It supplies the health half when tied to an identifiable person whose visit relates to their own health or care, as on a booking or portal page. A URL can also carry an identifier, such as an email. The health half is the first test in 160.103. "Web Universal Resource Locators (URLs)" are also item (N) of 164.514(b)(2)(i). For public pages, see the court order below.
IP address	When it is connected to health information about the person, as inside a portal or with an appointment request. A visit to a public page about a condition is not enough on its own. Item (O) of 164.514(b)(2)(i), "Internet Protocol (IP) address numbers"; AHA v. Becerra on public pages. See are IP addresses PHI.
Cookie and device IDs	When the ID can be used to identify one person and is linked to their health information. A cookie ID is not named on the list; a unique code can fall under item (R). Item (M) of 164.514(b)(2)(i), "Device identifiers and serial numbers". HHS says (R) covers unique features that "could be used to identify a particular individual."
Email address and phone number	When collected with health, care or payment information: a booking, an intake form, a portal sign-up. Items (F) and (D) of 164.514(b)(2)(i). Of a name and email typed on a portal sign-up page, the HHS bulletin says "such information meets the definition of IIHI." On hashing, see is a hashed email PHI.
A phone call from the site	When the caller's number, a recording or a transcript is tied to why they called a covered provider. Health information is covered "whether oral or recorded in any form or medium" under 160.103. See call tracking and PHI.
Logged-in patient portal pages	Generally yes. A login ties what the visitor does to an identified patient. HHS bulletin: "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI."
Public pages with no login	Usually not. What the page collects becomes PHI once a visitor types or selects health details, books, or enters sign-up or login details. HHS bulletin: "Tracking technologies on many unauthenticated webpages do not have access to individuals' PHI."

HHS tracking bulletin and AHA v. Becerra: what was vacated, what stands

HHS publishes a bulletin on online tracking technologies, first issued in December 2022 and revised on March 18, 2024. On June 20, 2024, the U.S. District Court for the Northern District of Texas ruled on it in American Hospital Association v. Becerra, No. 4:23-cv-01110-P.

What was vacated. One position, which the court called the "Proscribed Combination." HHS's notice at the top of the bulletin describes it: HIPAA obligations triggered in "circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers." The court declared it unlawful and vacated it, finding it was "promulgated in clear excess of HHS's authority under HIPAA." Its reasoning: a site cannot know why a visitor reads a public page, and "HIPAA doesn't mandate clairvoyance."

What stands. The court denied a permanent injunction and limited the vacatur in a footnote: "Such vacatur is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." So the rest of the bulletin remains HHS's guidance, including its examples on logins, forms and booking. The order did not change 45 CFR 160.103 or 164.514. The government filed a notice of appeal on August 19, 2024, and the Fifth Circuit dismissed it on September 4, 2024 on the government's own motion, the docket shows. As of October 13, 2026, the bulletin's notice still ends: "HHS is evaluating its next steps in light of that order."

In practice, an IP address plus a page view on a public condition page is not PHI on that basis alone. Once the visitor types, selects, books or logs in, the bulletin's other examples apply. See Curve's annotated guide to the bulletin.

What changes once a data point is PHI

The HHS bulletin says "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." A banner is no substitute: "Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization." See is a cookie banner enough for HIPAA.

Data that is not PHI is not free of rules. In its section on apps, the HHS bulletin notes that where the HIPAA Rules do not apply, "other law may apply," and it names the FTC Act.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform.

Curve Forms hosts intake and appointment request forms under your BAA, with the ad and campaign attached to each lead. The free Curve Compliance scanner lists the tracking scripts on a page. Curve handles this data under the BAA it signs on every plan (BAA Directory entry), and Curve's team does the setup; most customers are live in about a week. For how these rules apply to your own site, talk to your counsel, and book a call with Curve.

Sources, checked October 13, 2026: 45 CFR 160.103; 45 CFR 164.514; HHS, online tracking technologies bulletin; HHS, de-identification guidance; American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. June 20, 2024); and its district court docket.

Frequently Asked Questions

What counts as PHI on a website?

Under 45 CFR 160.103, anything that can identify a visitor and relates to their health, care or payment for care, once a HIPAA covered entity or its business associate collects or sends it. Appointment requests, intake answers and patient portal activity are the common cases.

Is an IP address PHI?

Sometimes. It is a listed identifier under 164.514(b)(2)(i)(O), and it is PHI when a covered entity holds it tied to health information about the person. In AHA v. Becerra, a court vacated HHS's position that an IP address plus a visit to a public page about a condition triggers HIPAA. See our guide to IP addresses and PHI.

Is an email address PHI by itself?

Not by itself. HHS says identifying information alone "would not necessarily be designated as PHI." It becomes PHI when a covered entity holds it with health, care or payment information. Hashing is its own question: see our hashed email guide.

Is a URL with a condition name in it PHI?

Not on its own. Under 45 CFR 160.103, it becomes PHI only when it is tied to an identifiable person and relates to that person's own health or care, as on a booking or portal page.

Did AHA v. Becerra strike down the HHS tracking bulletin?

No. On June 20, 2024 the court vacated one position: that HIPAA is triggered when a tracker connects an IP address with a visit to a public, unauthenticated page about health conditions or providers. A footnote in the opinion says the vacatur does not limit "the legal operability of other guidance in the germane HHS document."

Is a contact form on a clinic website PHI?

It is when a HIPAA covered entity's form ties a person to care. In the HHS bulletin's booking example, where a tracker collects an email address or a reason for seeking care, "the regulated entity is disclosing PHI to the tracking technology vendor." Curve Forms hosts intake and appointment request forms under your BAA.

Talk to Curve Compliance

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, set up server-side conversions, and sign a BAA on every plan. Book a call with Curve.