Table 1.

Elements That Must Be Removed From PHI for It to Be De-identified

PHI = protected health information; URL = uniform resource locator; IP = Internet protocol; HIPAA = Health Insurance Portability and Accountability Act.

  1. Patient’s name

  2. Geographic subdivisions smaller than state

  3. Dates (except year) directly related to patient

  4. Telephone numbers

  5. Fax numbers

  6. E-mail addresses

  7. Social security numbers

  8. Medical record numbers

  9. Health plan beneficiary numbers

  10. Account numbers

  11. Certificate/license numbers

  12. Vehicle identifiers and serial numbers

  13. Device identifiers and serial numbers

  14. Web URLs (http://...)

  15. IP address numbers

  16. Biometric identifiers, including finger and voice prints

  17. Full-face photographic images and any comparable image

  18. Any other unique identifying number, characteristic, or code except as permitted under HIPAA to reidentify data