What is protected health information (PHI) in marketing?
Protected health information (PHI) is individually identifiable health information that a HIPAA covered entity, or its business associate, creates, receives, stores or transmits. In marketing, PHI is not only medical records. A web form asking about a condition, a recorded call, an appointment list or a patient email list can all contain PHI once they link a person to the practice or to their health.
- PHI = health information + something that identifies the person, held by a covered entity or business associate.
- Marketing data that often contains PHI: form fills, call recordings, CRM records, patient lists, booking data.
- HIPAA lists 18 identifiers; removing them under the safe-harbor method is one route to de-identified data.
- Any vendor that handles PHI for a practice needs a BAA.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What makes information PHI
Under HIPAA, health information covers a person's past, present or future physical or mental health, the care they received, and payment for that care. It becomes PHI when it can identify the individual and is held or sent by a covered entity, such as a practice or health plan, or by a business associate working for one.
Identifiers include names, addresses smaller than a state, dates tied to a person, phone numbers, email addresses, IP addresses, device identifiers, photos of the face and other unique codes. HIPAA's safe-harbor method lists 18 identifier types that must be removed for data to count as de-identified. The other route is an expert determination that the risk of re-identification is very small.
Information outside HIPAA, such as health data a consumer app collects directly, may still be covered by the FTC Act, the FTC Health Breach Notification Rule or state health privacy laws.
Where PHI shows up in practice marketing
- Website forms: a contact form where someone writes "I need knee surgery" alongside a name and phone number.
- Call tracking: recordings and transcripts of patient calls.
- CRM and booking tools: enquiry records, appointment types, no-show notes.
- Ad audiences: patient lists uploaded for targeting or exclusion.
- Tracking technologies: pixels that send page views, IP addresses and form events to third parties.
Each of these flows needs a vendor that will sign a BAA, or a setup that keeps PHI out of the tool. See the HIPAA-safe website tracking guide and our page on what to require from agencies and vendors.
Common mistakes and limits
Practices often assume that data without a diagnosis is not PHI. A list of names and phone numbers of patients is PHI, because it reveals a relationship with a healthcare provider. Another mistake is treating hashed data as anonymous. HHS has said that hashing or encrypting identifiers does not, by itself, make them de-identified.
The reverse error also happens. Aggregate, de-identified reporting, such as total leads by channel, is generally not PHI and can be shared more freely. Build reports that way where possible. When in doubt about a specific data flow, check with your compliance or legal team, and read our HIPAA compliance by role overview.
Related pages from the US team
HIPAA-safe website tracking
Measure marketing without leaking PHI.
HIPAA for agencies and vendors
What practices should require from marketing vendors.
Business Associate Agreement (BAA)
The contract every PHI-handling vendor needs.
US healthcare marketing glossary
Every term, defined in plain English.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Is a patient's name and phone number PHI?
Yes, when a covered entity or its business associate holds it in a way that shows the person is a patient. The link to a healthcare provider makes it health-related. A list of practice patients' names and phone numbers is PHI even without diagnoses.
Is a website enquiry form PHI?
It can be. If a practice's form collects a name or contact details together with a health concern, appointment type or treatment interest, the submission is generally treated as PHI. The form tool and anyone receiving the data should be covered by a BAA.
Does hashing an email address make it safe to share with ad platforms?
Not under HIPAA by default. HHS has said hashing identifiers does not de-identify them. If the email belongs to a patient, sharing it with an ad platform for marketing generally needs a HIPAA basis, usually patient authorization, and a vendor relationship that allows it.
Is aggregate marketing data PHI?
Generally no. Reports showing totals, such as calls per channel or bookings per month, without information that identifies individuals are usually not PHI. Small counts or detailed breakdowns can still identify people, so review them with care.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Not sure where PHI sits in your marketing stack?
A 30-minute call with the US team. We'll map forms, call tracking and CRM flows and show where PHI travels.
We cover every stage, from first search to repeat visit
- 0Foundations
- 1Demand gen
- 2Capture
- 3Lead quality
- 4Lead mgmt
- 5Scheduling
- 6Show-up
- 7Conversion
- 8Retention
We work across all nine stages, from foundations to past patients, and fix the stage that leaks first. Our own software runs the work, and every stage is reported against a monthly target on Ichelon Agency OS.
See all nine stages and the tool behind each one →