Last verified: October 2026, against 45 CFR 160.103 and the June 2024 AHA v. Becerra ruling. General information, not legal advice — confirm with your compliance officer or attorney.
Is a phone number PHI? On its own, no. A phone number becomes protected health information when your practice, or a vendor working for it, holds it in connection with someone's care. The same rule answers the questions about names, emails, birth dates and IP addresses that practice staff search for: "is a phone number phi" about 140 times a month, "is date of birth phi" 90, "is email address phi" 70, "is a name phi" 40 and "is ip address phi" 30 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
In short: A phone number, email, name, birth date or IP address is PHI when a covered entity or business associate holds it and it is linked to a person's health, care or payment for care. Even linking it to the fact that someone is your patient qualifies. Out of that context, it's ordinary personal data.
The rule: identifiers become PHI when linked to care
The test comes from 45 CFR 160.103 (opens in a new tab). Information is individually identifiable health information when it is created or received by a provider, plan, employer or clearinghouse, relates to a person's health, "the provision of health care to an individual," or payment for care, and identifies the person or could reasonably be used to. In the hands of a covered entity or business associate, that is PHI. Our hub on what is PHI covers the full definition and its exclusions.
Two consequences follow. First, an identifier alone, in a non-health setting, is not PHI. Second, almost anything a practice holds about its patients is linked to care, because the relationship itself is care. A plain list of names in your EHR tells anyone who sees it that these people are your patients.
Each identifier below appears on the 18 HIPAA identifiers list, so none of them can stay in a data set you want to call de-identified.
Is a phone number PHI?
A phone number is PHI when it sits in your scheduling system, recall list, call log or a form submission asking for an appointment. It is not PHI on a sign-up sheet at a community health fair that never reaches a patient record.
Watch for phone numbers in places staff don't think of as records: missed-call notifications forwarded to a personal phone, text threads about rescheduling, and call-tracking or answering-service logs. Each holds numbers linked to care, so each needs a vendor under a business associate agreement (BAA) and access limited to the people who need it.
Is an email address PHI?
An email address becomes PHI once it is tied to care. A subscriber to a general wellness newsletter, kept in a list that never touches patient records, is not PHI. The same address in a form that says "I'd like a consult for my daughter's acne" is.
Email lists are where practices most often cross the line without noticing. Exporting patient emails into a newsletter tool turns that tool into a holder of PHI. Sending marketing to those patients may also need authorization under 45 CFR 164.508(a)(3) (opens in a new tab), depending on the message. See patient email lists before you import anyone.
Is a name PHI?
A name in your practice's systems is PHI because it reveals a patient relationship. A name in a list of job applicants or vendor contacts is not. Names cause the most trouble in conversation and review replies: "Hi Jordan, great to see you Tuesday!" in a public reply confirms a visit.
Name plus anything clinical is PHI everywhere it travels. That includes a calendar invite to a personal account titled "Jordan, Botox follow-up," or a shared spreadsheet of leads with a "concern" column.
Is a date of birth PHI?
A birth date your practice uses to verify identity or that sits in a patient record is PHI. It is also a special case under de-identification: 164.514(b)(2)(i)(C) (opens in a new tab) requires removing "all elements of dates (except year)" for dates related to an individual, plus ages over 89.
Marketing uses birthdays more than people expect: "happy birthday" emails, age-based ad audiences built from patient records, birthday discounts at med spas. Each one uses PHI, so each needs a lawful basis, a covered tool and often authorization. Ask only for what a task needs; the minimum necessary standard applies to what you collect and share.
Is an IP address PHI?
An IP address is item O on the de-identification list. When it is tied to a patient's portal login, an appointment request or a form that describes a condition, it is PHI, and sending it to an ad or analytics vendor without a BAA is a disclosure.
The harder case is a visitor reading a public page. HHS's online tracking guidance, first issued in December 2022 and revised on March 18, 2024, said an IP address connected to a visit to an unauthenticated page about specific health conditions or providers could be PHI. On June 20, 2024, the federal court in American Hospital Association v. Becerra (opens in a new tab) (N.D. Tex.) declared that combination, which it called the "Proscribed Combination," unlawful and vacated it. The court added that the vacatur should not be read as limiting "other guidance in the germane HHS document."
As of the ruling, then: an IP address plus a visit to a public condition page is not, by that combination alone, PHI under HHS's guidance. An IP address attached to a booking, a form submission or a logged-in session still can be. For setup details see IP addresses and tracking pixels.
Website and marketing scenarios, side by side
Illustrative example: the scenarios describe a fictional dermatology practice.
| Scenario | PHI? | Why |
|---|---|---|
| Newsletter signup (email only) on a general sun-safety blog post, stored apart from patient records | Generally no | No link to care or to the patient relationship |
| Appointment request: name, phone, "reason: suspicious mole" | Yes | Identifiers plus a condition and a request for care |
| Same request, with the confirmation page URL containing the reason, sent to an ad pixel | Yes, and a disclosure | The vendor receives identifiers tied to care without a BAA |
| Reply to a review: "Thanks, Priya, glad the biopsy came back clear" | A disclosure of PHI | Confirms a patient relationship and a test result |
| Analytics hit from an anonymous visitor on a public "eczema treatment" page | Not PHI by that combination alone, after the June 2024 ruling | The court vacated HHS's position on this combination |
| Same visitor, after logging in to the patient portal | Yes | Identity and patient status are known |
The pattern holds across rows: the more your form or tool links a person to care, the more it needs HIPAA-compliant forms and vendors under a BAA. Medfy's forms store submissions in separate, encrypted HIPAA databases in the US or Canada, and ad platforms never receive patient data; details are in Medfy's patient-data safeguards. To check whether your current pages send any of this to third parties, run a free marketing audit.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Is a patient's phone number PHI?
Yes, when your practice holds it as a patient's number. In your scheduling system, recall list or call log, it identifies someone and shows they receive care from you, which meets HIPAA's definition. The same number on a general sign-up sheet at a community event isn't PHI until it is linked to care. Treat every number in a patient system as PHI and confirm edge cases with your compliance officer or attorney.
Is an email address on a contact form PHI?
It usually becomes PHI once the form ties it to care, for example a request for a consultation or a question about symptoms. An email-only subscription to a general newsletter, kept apart from patient records, generally isn't. The risk is in the details people add, so design forms that ask only what a callback needs. General information, not legal advice: confirm your form setup with your compliance officer or attorney.
Is a name plus an appointment time PHI?
Yes. A name identifies the person and an appointment time relates to the provision of health care, so the pair is PHI whenever your practice or a vendor working for it holds it. That is why a screenshot of tomorrow's schedule, a calendar invite to a personal account or a reminder text that names the visit type all need the same care as a chart note.
Is an IP address PHI under HIPAA?
Sometimes. An IP address is one of the 18 identifiers, so tied to a patient's portal session or a submitted appointment form, it is PHI. In June 2024 a federal court vacated HHS's position that an IP address plus a visit to a public health-condition page is enough on its own. Keep pixels off logged-in and form pages either way, and confirm your setup with your compliance officer or attorney.