Every D2C health brand holds two kinds of customer data. One is ordinary e-commerce PII. The other is PHI, and it decides which tools need a BAA.
The words get used like synonyms. They are not. The rest of this page is the line, with examples.
What counts as PII
PII is personally identifiable information: any data that identifies a specific person, alone or in combination with other data. Name, email, phone number, shipping address, IP address, device ID, order history.
There is no single federal PII statute. The definition most frameworks borrow comes from NIST Special Publication 800-122: information that can be used to distinguish or trace an individual’s identity, plus anything linked or linkable to that individual. State privacy laws like California’s CCPA regulate it, and the FTC polices unfair handling of it. Every business that takes orders holds PII. Nothing about the category is specific to health.
What counts as PHI under HIPAA
PHI is protected health information. Unlike PII, it has a precise legal definition at 45 CFR 160.103. Data is PHI when three things are true at once:
- It identifies an individual, or could.
- It relates to health: a physical or mental condition, care provided, or payment for care. Past, present, or future all count.
- It is created, received, maintained, or transmitted by a HIPAA covered entity (a provider, health plan, or clearinghouse) or by a business associate working for one.
The third condition is the one operators miss. HIPAA regulates who holds the data, not data floating in the abstract. A blood panel inside your telehealth platform is PHI. The same numbers typed into a consumer fitness app are not, because no covered entity or business associate ever touches them.
Non-HIPAA health data is still regulated. The FTC fined GoodRx $1.5 million in February 2023 and BetterHelp $7.8 million a month later for sharing health data with advertisers. It bites through a different agency.
Where PHI and PII overlap: the diagram in words
Picture two circles. The big one is PII: everything that points to a specific person. Inside it sits a smaller circle, PHI: the subset that also carries health context and sits with a covered entity or business associate.
Every piece of PHI contains or links to an identifier, so in practice all PHI is also PII. The reverse fails constantly: most PII never comes near the small circle. Your paid-traffic email list is pure PII. So are your supplier contacts.
Data crosses from the big circle into the small one when the other two conditions arrive: health context, plus a covered entity or business associate holding it. For a telehealth brand, that crossing has a specific moment: intake. The visitor who clicked your Meta ad is a lead, and their email is PII. When they submit an intake form to your medical group, the same email becomes part of a treatment relationship. Same string of characters, different legal regime.
Context alone can push data across the line. An email address in your ESP is PII. The same address in a segment named “completed checkout, semaglutide” is health information tied to an identity. Lists leak diagnoses through their titles.
PHI vs PII examples
| Data point | PII | PHI | Why |
|---|---|---|---|
| Email captured by a quiz lead magnet | Yes | No | Identifies a person; no treatment relationship yet |
| Same email on your patient roster | Yes | Yes | Identity plus care context, held by your provider group |
| Appointment date with a provider | Yes | Yes | Dates tied to care are HIPAA identifiers |
| Prescription and dosage tied to a name | Yes | Yes | Health data plus identity |
| Site-wide conversion rate | No | No | Identifies nobody |
| IP address in analytics on a patient portal | Yes | Treat as yes | See the tracking note below |
| Blood panel with all 18 identifiers removed | No | No | Properly de-identified data exits HIPAA |
| Employee SSN in your payroll system | Yes | No | Employment records are excluded from PHI |
The tracking note: in December 2022, HHS’s Office for Civil Rights published a bulletin arguing that an IP address combined with a visit to a health-related webpage could itself be PHI. In June 2024, a federal court in Texas vacated the portion of that guidance covering unauthenticated pages. The litigation trimmed the edges, but OCR’s interest in tracking technology did not go away. The defensible position: keep third-party trackers off any page behind a patient login, and be deliberate about what fires on intake flows.
Why the PHI vs PII line decides your compliance stack
The operating rule is short. Any system that stores, processes, or transmits PHI needs a signed BAA with that vendor, plus the security controls behind it. Systems that only ever hold non-patient PII can be ordinary SaaS. Walk your stack with that rule and the architecture mostly draws itself.
Ad platforms and pixels: PII side only. Meta, Google, and TikTok do not sign BAAs for their standard pixels, so pixels belong on marketing pages, never inside intake or the patient portal. Whatever conversion data flows back to them has to be stripped of health context first.
CRM: a CRM that only holds leads who never became patients can be regular SaaS. Once patient status, visit notes, or refill dates land in it, it is holding PHI and needs to be a HIPAA-compliant CRM under a BAA.
Email: same split, sharper teeth. A prospect newsletter can run on anything. Refill reminders, “your provider reviewed your labs,” or a send list whose name implies a condition all require HIPAA-compliant email. Klaviyo, the default ESP for most e-commerce brands, does not sign BAAs.
The clinical core: intake, visits, e-prescribing, pharmacy, patient messaging. All PHI, all the time. This layer runs on a HIPAA-compliant telehealth platform or it does not run legally.
Analytics: aggregates are safe. Session-level tracking of identifiable patients on care pages is where brands get caught, per the OCR bulletin above.
Count the tools on the PHI side of your line and you have counted your BAAs. Each one is a vendor security review, a subprocessor list, and a place where an audit can start. That vendor math is the argument for consolidating the clinical core. Remedora covers storefront, funnels, intake, licensed providers in all 50 states plus Puerto Rico, e-prescribing, pharmacy fulfillment, and payments under one BAA. One BAA and one ledger is enough.
De-identification basics: how PHI stops being PHI
HIPAA recognizes exactly two ways to de-identify data (45 CFR 164.514).
Safe Harbor: remove all 18 listed identifiers, including names, geographic units smaller than a state, all date elements except year, phone numbers, email addresses, SSNs, medical record numbers, account numbers, device serials, URLs, IP addresses, biometrics, and full-face photos, and have no actual knowledge that what remains could identify someone.
Expert Determination: a statistician or similarly qualified expert applies accepted methods and documents that the risk of re-identification is very small.
Once data is properly de-identified, it leaves HIPAA entirely. That is what lets you use cohort-level data for LTV models, ad optimization, and investor decks without dragging a BAA requirement along with it.
The trap is half-measures. Stripping names while keeping ZIP code, birth date, and condition produces a redacted dataset, not a de-identified one. Latanya Sweeney’s research at Carnegie Mellon found that 87 percent of Americans can be uniquely identified from ZIP code, birth date, and sex alone. If your “anonymized” export can be joined back to a person, it never left the small circle.
PHI vs PII FAQ
Is all PHI also PII?
In practice, yes. PHI is individually identifiable by definition, so it always contains or links to an identifier. The reverse is false: most PII has no health context and no covered entity holding it.
Is an email address PHI?
By itself, no. Tied to a treatment relationship, yes. The same address is PII on your lead list and PHI on your patient roster.
Does HIPAA apply to my supplement or wellness brand?
Not if no covered entity or business associate is involved: no providers, no prescriptions, no insurance claims. The FTC still regulates how you handle health data, as GoodRx and BetterHelp found out. Add a medical group and prescribing, and HIPAA arrives with them.
What is ePHI?
PHI in electronic form. The HIPAA Security Rule’s technical safeguards, meaning access controls, encryption, and audit logs, apply to ePHI specifically. For a telehealth brand, effectively all PHI is ePHI.
Draw the line before someone draws it for you
The exercise worth doing this week takes an hour. List every tool that touches customer data. Mark the ones holding anything about patients. Check each mark for a BAA. Marks without BAAs are your exposure: move the data, replace the tool, or get the paperwork signed.
If the PHI side of your list ends up longer than you want to maintain, schedule a Remedora demo and see what one vendor and one BAA look like in practice.
