On this page
IIHI, individually identifiable health information, is health information, including demographic information, that a health care provider, health plan, employer or health care clearinghouse creates or receives, that relates to a person's health, care or payment for care, and that identifies the person or could reasonably be used to identify them (45 CFR 160.103). PHI is IIHI that is transmitted or maintained in any form, minus a few exclusions such as FERPA education records and employment records. Curve Compliance, a marketing and website tracking service for healthcare that signs a BAA on every plan, checked each definition on eCFR and HHS on November 2, 2026.
Book a call. Not sure whether your website sends IIHI to ad platforms? Curve Compliance handles the marketing and website tracking side: it strips PHI before data reaches an ad platform and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve's team reviews what your site sends with you and does the setup, typically live in about a week. Book a call with Curve.
IIHI defined
The HIPAA definition reads: “Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual,” and it must meet all three of these tests (45 CFR 160.103):
- Who holds it. It “Is created or received by a health care provider, health plan, employer, or health care clearinghouse” (eCFR).
- What it is about. It “Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual” (eCFR).
- Whether it points to a person. It identifies the individual, or there is “a reasonable basis to believe the information can be used to identify the individual” (eCFR).
“Health information” on its own is wider. It can be created or received by “a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse” (eCFR). IIHI narrows that to four sources and adds identifiability. HHS's summary says IIHI “includes many common identifiers (e.g., name, address, birth date, Social Security Number)” (HHS).
IIHI vs PHI vs ePHI
The three terms nest inside each other. All definitions are from 45 CFR 160.103 (eCFR).
| Term | What it means | What it adds |
|---|---|---|
| Health information | Information, including genetic information, created or received by a provider, health plan, public health authority, employer, life insurer, school or university, or clearinghouse, that relates to health, care or payment for care | The widest category; no identifiability needed |
| IIHI | Health information, including demographic information, created or received by a provider, health plan, employer or clearinghouse, that identifies the person or reasonably could | Identifiability |
| PHI | IIHI that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium, minus four exclusions | What the Privacy Rule protects in a covered entity's or business associate's hands |
| ePHI | PHI transmitted by or maintained in electronic media | What the Security Rule protects |
HHS's tracking guidance puts the link plainly: IIHI is “a necessary pre-condition for information to meet the definition of PHI when it is transmitted or maintained by a regulated entity” (HHS). For the next step up, see PHI meaning and what ePHI is. For how PHI differs from the broader idea of personal data, see PHI vs PII.
What is excluded
The PHI definition carves out four kinds of IIHI. PHI excludes individually identifiable health information (45 CFR 160.103):
- “In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g”
- “In records described at 20 U.S.C. 1232g(a)(4)(B)(iv)”, which the Department of Education and HHS call treatment records under FERPA (joint guidance)
- “In employment records held by a covered entity in its role as employer”
- “Regarding a person who has been deceased for more than 50 years”
Those records can still be IIHI. They simply fall outside PHI, so HIPAA's Privacy Rule does not govern them; FERPA does for school records. See HIPAA vs FERPA vs GDPR for school health records and does HIPAA apply after death for the 50-year rule.
IIHI on websites and in ad data
HHS lists what tracking code on a regulated entity's site or app can pass to vendors: “an individual's medical record number, home or email address, or dates of appointments, as well as an individual's IP address or geographic location, device IDs, or any unique identifying code” (HHS). It then says: “IIHI collected on a regulated entity's website or mobile app generally is PHI, even if the individual does not have an existing relationship with the regulated entity and even if the IIHI, such as in some circumstances IP address or geographic location, does not include specific treatment or billing information like dates and types of health care services” (HHS).
HHS also draws a limit. Connecting an IP address with a visit to a page about a condition “is not a sufficient combination of information to constitute IIHI if the visit to the webpage is not related to an individual's past, present, or future health, health care, or payment for health care” (HHS). And on June 20, 2024 a federal court vacated the part of the guidance on IP addresses and unauthenticated public pages about specific health conditions or providers (HHS).
On a clinic website, IIHI tends to show up where a visitor tells you something about their own care. Common places to check:
- Booking and intake forms. A name or email entered next to a visit type or symptom.
- Logged-in pages. Patient portal page views tied to a user ID or email.
- URLs and event names. A condition in a page address or event label next to an email or click ID. See are UTM parameters PHI.
- Customer lists. Patient emails or phone numbers uploaded to an ad platform for matching.
Whether a given field is IIHI depends on the page and what it is tied to, so talk to your counsel. For identifier by identifier detail, see 18 HIPAA identifiers in website data and are IP addresses PHI.
IIHI and de-identification
Once health information is de-identified, it is no longer IIHI or PHI. HHS says “the Privacy Rule does not restrict the use or disclosure of de-identified health information, as it is no longer considered protected health information” (HHS). There are two methods: Expert Determination and Safe Harbor (HHS).
Safe Harbor removes 18 types of identifiers of the person and of relatives, employers or household members (45 CFR 164.514): names; geographic subdivisions smaller than a state, with a narrow ZIP code exception; all elements of dates except year, and ages over 89; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers; full face photos; and any other unique identifying number, characteristic or code. The covered entity must also have no actual knowledge that what remains could identify the person. See de-identified vs anonymized data and the HIPAA limited data set.
How Curve Compliance helps
Curve Compliance works on the marketing and website tracking part of HIPAA, where IIHI most often leaks. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (BAA Directory entry). Curve's team does the setup, typically live in about a week. To see which trackers your pages load now, run the free website scan.
Sources, checked November 2, 2026: 45 CFR 160.103; 45 CFR 164.514; HHS, Summary of the HIPAA Privacy Rule; HHS, Guidance Regarding Methods for De-identification; HHS, Use of Online Tracking Technologies; Department of Education and HHS, Joint Guidance on FERPA and HIPAA (2019).
Frequently Asked Questions
What is IIHI under HIPAA?
IIHI is health information, including demographic information, that a provider, health plan, employer or clearinghouse creates or receives, that relates to a person's health, care or payment for care, and that identifies the person or reasonably could (45 CFR 160.103). It is the building block of PHI.
What does IIHI stand for?
Individually identifiable health information, a term defined in 45 CFR 160.103 (eCFR).
What is the difference between IIHI and PHI?
PHI is IIHI that is transmitted or maintained in any form or medium, minus four exclusions: FERPA education records, FERPA treatment records, a covered entity's employment records, and records of people deceased more than 50 years (45 CFR 160.103; joint guidance).
What does PHI stand for in the context of HIPAA?
Protected health information. See PHI meaning for the full definition and examples.
What are the Safe Harbor identifiers under HIPAA?
They are the 18 types of identifiers listed in 45 CFR 164.514(b)(2), from names, dates and contact details to IP addresses, URLs, device identifiers and full face photos (eCFR). Removing all of them, with no actual knowledge that the rest could identify someone, de-identifies the data.
Is de-identified data still IIHI?
No. De-identified health information “neither identifies nor provides a reasonable basis to identify an individual” (HHS), and HHS says it “is no longer considered protected health information” (HHS).
Is an IP address IIHI?
It can be. HHS says IIHI collected on a regulated entity's website generally is PHI, including in some circumstances an IP address, but in June 2024 a federal court vacated the part of that guidance on IP addresses tied to visits to unauthenticated public pages about specific health conditions or providers (HHS). See are IP addresses PHI.
Talk to Curve Compliance
Book a call. Want to keep IIHI out of your ad platforms without losing conversions? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.