{"page":"/blog/hipaa-compliant-programmatic-advertising","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Data element","Context","PHI?","Why (rule or ruling, date)"],"rows":[["IP address, user agent, page URL","Unauthenticated public page about a condition or a service","Not PHI per the court; HHS cannot enforce the contrary","AHA v. Becerra, N.D. Tex., 20 June 2024 (AHA). Still litigation-exposed under wiretap and state statutes (Sweat, 22 September 2025)"],["Same elements","Unauthenticated page, but the visitor is a known patient (cookie matched to CRM, email link click, logged-in state remembered)","PHI","Identifier plus relation to the individual's care; OCR bulletin example of the patient seeking a second opinion (Norton Rose Fulbright, 21 March 2024)"],["Any identifier plus event","Patient portal, login page, appointment scheduling, symptom checker, prescription refill, bill pay","PHI","OCR bulletin, both versions; not vacated (Shook Hardy & Bacon, 22 March 2024)"],["App identifier plus health feature use","Mobile app of a covered entity (diabetes management example)","Generally PHI","OCR bulletin, March 2024 example (Norton Rose Fulbright, 21 March 2024)"],["Hashed email or phone from a patient list","Uploaded to an ad platform as a custom audience","PHI (hashing is not de-identification; the list exists because the people are patients)","164.514(b) requires removal of email and phone; a hash is a \"unique identifying code\" under item (R) (45 CFR 164.514, LII)"],["Aggregate counts (e.g., 4,200 visits to cardiology pages last week)","Reporting, planning","Not PHI if no identifier and no small-cell risk","164.514(a) definition of de-identified (45 CFR 164.514, LII)"],["Cohort or segment built from patient data with an expert determination","Used for targeting on third-party media","Not PHI if the determination holds for the data actually transferred; PHI if a device or cookie key leaves with it","164.514(b)(1) expert determination (45 CFR 164.514, LII)"],["Precise location near a clinic","Any ad use","Not HIPAA PHI unless held by a covered entity about a patient, but banned or restricted by state law","Washington 2,000-foot geofence rule (RCW 19.373.010); Nevada 1,750 feet (NRS 603A.540)"]],"sourceUrls":[["https://www.aha.org/news/news/2024-06-20-judge-rules-favor-aha-vacating-hhs-online-tracking-bulletin-unlawful-and-beyond-agency-authority","https://blogs.duanemorris.com/classactiondefense/wp-content/uploads/sites/56/2025/09/Sweat-v.-Houston-Methodist-Hospital-Opinion.pdf"],["https://www.dataprotectionreport.com/2024/03/hhs-updates-online-tracker-guidance/"],["https://www.shb.com/intelligence/client-alerts/pds/march-2024-revised-ocr-bulletin-saikali"],["https://www.dataprotectionreport.com/2024/03/hhs-updates-online-tracker-guidance/"],["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.010","https://www.leg.state.nv.us/nrs/NRS-603A.html"]]}