Yes – even email addresses that do not contain any identifying information are considered to be PHI. The logic behind this is twofold: first, with relatively little effort, the owner of the email address can be sourced. Secondly, it would be impractical for HIPAA to distinguish between different degrees of anonymity, so it is easier to apply a blanket statement and protect all email addresses.