On this page
PII, or personally identifiable information, is “Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual,” in the definition NIST's glossary takes from OMB Circular A-130 (NIST). On a health website, PII becomes protected health information when it is part of health information that a provider, health plan or clearinghouse creates or receives about a person's health, care or payment for care, so a name or email tied to a booked appointment can be PHI (45 CFR 160.103; HHS). Curve Compliance, which helps health brands measure ads without sending health data to ad platforms, checked every source below on November 9, 2026.
Book a call. Not sure which personal details your site sends to ad platforms? Curve's team will review what your website sends to Meta, Google and TikTok with you. Curve Compliance strips PHI before data reaches an ad platform and signs a BAA on every plan. Book a call with Curve.
PII, defined
NIST's glossary collects several federal definitions. The broader one, from NIST SP 800-122, covers “any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information” (NIST SP 800-122). The Department of Labor uses the same short definition as the opening of this page (DOL).
Two ideas carry the definition. To distinguish or trace means the data can single out one person. Linked or linkable means data that identifies no one on its own still counts once it can be joined to data that does. That second idea is why marketing data so often turns out to be PII: a cookie value or user ID is harmless alone, until it is joined to a form submission that carries a name.
PII examples
NIST SP 800-122 lists examples of “information that may be considered PII” (NIST SP 800-122). Here they are, with where each tends to show up in marketing data:
| NIST category | NIST's examples | Where it shows up in marketing data |
|---|---|---|
| Name | “full name, maiden name, mother's maiden name, or alias” | Lead forms, CRM records, booking confirmations |
| Personal identification number | “social security number (SSN), passport number, driver's license number, taxpayer identification number, patient identification number, and financial account or credit card number” | Intake and checkout flows; keep these out of analytics and ad tools entirely |
| Address information | “street address or email address” | Newsletter signups, lead forms, customer lists |
| Asset information | “Internet Protocol (IP) or Media Access Control (MAC) address or other host-specific persistent static identifier that consistently links to a particular person or small, well-defined group of people” | Server logs and the requests a browser pixel makes |
| Telephone numbers | “mobile, business, and personal numbers” | Call tracking, text message lists, lead forms |
| Personal characteristics | “photographic image (especially of face or other distinguishing characteristic), x-rays, fingerprints, or other biometric image or template data” | Before-and-after photos, uploaded files |
| Linked or linkable information | “date of birth, place of birth, race, religion, weight, activities, geographical indicators, employment information, medical information, education information, financial information” | Quiz answers, eligibility screens, page paths |
NIST adds that “Partial identifiers, such as the first few digits or the last few digits of SSNs, are also often considered PII because they are still nearly unique identifiers and are linked or linkable to a specific individual” (NIST SP 800-122).
Is an email address PII? Is an IP address?
Both are on NIST's list of information that may be considered PII: address information includes “street address or email address,” and asset information includes an “Internet Protocol (IP) or Media Access Control (MAC) address” (NIST SP 800-122). Whether either one is also PHI is a separate question that turns on who holds it and what it is tied to.
HHS's tracking bulletin is the main federal guidance on that second question for websites, with one limit to know: in June 2024 a federal court vacated the bulletin's guidance for “circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers” (HHS). The appointment example in the section on ad pixels below is outside that vacated part. For the email question in detail, see is an email address PHI.
When PII becomes PHI
HIPAA does not use the term PII. It defines individually identifiable health information instead: “Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual,” that a health care provider, health plan, employer or health care clearinghouse creates or receives, that relates to “the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual,” and that either identifies the person or gives “a reasonable basis to believe the information can be used to identify the individual” (45 CFR 160.103). Protected health information is that information in any form or medium, with a few exclusions such as employment records a covered entity holds as an employer.
So the same email address is plain PII on a retail newsletter list and PHI when a clinic's booking system records it next to an appointment. HIPAA's de-identification standard names the identifiers that have to come out, including “Names,” “Electronic mail addresses,” “Web Universal Resource Locators (URLs)” and “Internet Protocol (IP) address numbers” (45 CFR 164.514(b)(2)). Whether your organization is a covered entity or business associate decides which side of the line you are on, so talk to your counsel if you are unsure. For more, see PHI vs PII, what is IIHI and the 18 HIPAA identifiers on website data.
PII in ad pixels and conversion uploads
HHS defines a tracking technology as “a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app.” Its example: when a patient “makes an appointment through the website of a covered health clinic” and that site uses third-party tracking, “the website might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor. In this case, the tracking technology vendor is a business associate, and a BAA is required” (HHS).
Conversion uploads raise the same question from the other side. A list of people who booked, sent to an ad platform, pairs identifiers with the fact of a booking. Check what each field reveals before it leaves your systems, and see which lead fields can reach your ad platforms.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and events can use neutral names. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.
Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. For how HIPAA treats marketing uses of personal data, see the HIPAA marketing rule. For product analytics, see Mixpanel vs Amplitude for healthcare.
Sources, checked November 9, 2026: NIST glossary, personally identifiable information; NIST SP 800-122; Department of Labor, Guidance on the Protection of PII; 45 CFR 160.103 and 45 CFR 164.514 (eCFR, current as of November 5, 2026); HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is PII?
PII is information that can be used to distinguish or trace a person's identity, alone or combined with other information linked or linkable to that person (NIST). Names, email addresses, phone numbers and IP addresses are common examples.
Is an email address PII?
Yes. NIST lists address information “such as street address or email address” among its PII examples (NIST SP 800-122). On a covered provider's site, an email tied to a booking can also be PHI.
Is an IP address PII?
NIST lists IP and MAC addresses as asset information that may be considered PII (NIST SP 800-122). HIPAA's de-identification standard also names “Internet Protocol (IP) address numbers” as an identifier (45 CFR 164.514).
What are examples of PII?
NIST's examples include names, identification numbers such as a Social Security or passport number, street and email addresses, IP and MAC addresses, phone numbers, photos and biometric data, plus details linked to a person such as date of birth, employment, medical or financial information (NIST SP 800-122).
What is the difference between PII and PHI?
PII is any information that can identify a person. PHI is individually identifiable health information that HIPAA protects, so all PHI is PII but most PII is not PHI. See PHI vs PII.
Is hashed data still PII?
It depends on whether the hashed value can still be linked to a person. NIST's definition covers information that is “linked or linkable to a specific individual” (NIST); for HIPAA's view of hashed emails, see is a hashed email PHI.
Is a name alone PII?
Yes. NIST's examples start with “Name, such as full name, maiden name, mother's maiden name, or alias” (NIST SP 800-122).
Talk to Curve Compliance
Book a call. Want to know which personal details your website sends to ad platforms today? Curve's team will review what your site sends to Meta, Google and TikTok with you and set up server-side conversions that strip PHI before data reaches an ad platform, under a BAA on every plan. Book a call with Curve.