Table 1 HIPAA eighteen direct identifiers
From: Protecting patient privacy when sharing patient-level data from clinical trials
A. Name |
B. Geographic subdivisions smaller than a state. The initial three digits of a ZIP code can be retained if certain criteria are met. |
C. With the exception of year, all elements of dates directly related to an individual (such as birth date, admission date, discharge date, date of death). For ages over 89 and elements of dates (including year) indicating such an age, ages and elements may be aggregated into a single category of age 90 or older. |
D. Telephone numbers, |
E. Fax numbers |
F. Email addresses |
G. Social security numbers |
H. Medical record numbers |
I. Health plan beneficiary numbers |
J. Account numbers |
K. Certificate/licence numbers |
L. Vehicle identifiers and serial numbers, including license plate numbers |
M. Device identifiers and serial numbers |
N. Web Universal Resource Locators (URLs) |
O. Internet Protocol (IP) addresses |
P. Biometric identifiers, including finger and voice prints |
Q. Full-face photographs and any comparable images |
R. Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of HIPAA Safe Harbor section; and |
S. The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information |