In response to a case of an undocumented patient who was reported to immigration authorities, this commentary considers whether a patient's immigration status should be deemed protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. A legal argument, supported by clinical data, is offered that immigration status should be regarded as PHI not subject to valid exception for release without patient authorization. This argument concludes that covered entities (eg, hospitals and health care professionals) are legally precluded under the HIPAA Privacy Rule from disclosing a patient's immigration status.