HIPAA: The 18 Protected Health Information (PHI) Identifiers
In order for a record (or research data set) to be considered de-identified, each of the above identifiers must be removed. This is applicable to identifiers of the individual, or of relatives, employers, or household members of the individual.
- Names
- Geographic subdivisions smaller than a state if it contains less than 20,000 people (the initial three digits of the zip code are allowed). This includes street address, city, county, precinct, and zip code (or equivalent geocodes).
- The initial three digits of a zip code may be included if, according to the currently publicly available data from the Bureau of Census the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people, and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to “000”
- Dates
- All elements of dates (except year) for dates directly related to an individual (including birth date, admission date, date of service, discharge date, date of death), and all ages over 89 (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
- Telephone numbers
- Fax numbers
- E-mail addresses
- Social security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers, serial numbers, and license plate numbers
- Device identifiers and serial numbers
- Internet Universal Resource Locators (URLs)
- Computer Internet Protocol (IP) addresses
- Biometric identifiers
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic, or code, except as permitted for re-identification of the de-identified data