Lesson Progress
0% Complete
Specific pieces of data (data elements) can, individually or in combination, be used to uniquely identify an individual. The following data elements can be used to uniquely identify, and, as such, must be de-identified under the safe harbor rule:
- Names
- Geographic locators
- In the case of zip codes, providers are generally permitted to use the first three digits, provided the geographic unit formed by combining those first three digits contains more than 20,000 individuals
- All elements of dates (except the year) that are related to an individual
- This information includes including admission and discharge dates, birthdate, date of death, all ages over 89 years old, and elements of dates (including year) that are indicative of age
- Telephone, cellphone, and fax numbers
- Email addresses
- IP addresses
- IP addresses can be used to identify physical addresses
- Social Security Numbers
- Medical record numbers
- Health plan beneficiary numbers (e.g., the member ID on a patient’s health insurance card)
- Device identifiers and serial numbers (medical devices are assigned unique serial numbers)
- Certificate/license numbers (e.g., driver license numbers and birth certificate numbers)
- Account numbers (e.g., bank account numbers)
- Vehicle identifiers and serial numbers, including license plates
- Website URLs; If a URL is logged within a specific application, the URL can be used to uniquely identify an individual
- Full face photos and comparable images
- Biometric identifiers (including fingerprints, voiceprints, and retinal images)
- Any unique identifying numbers, characteristics, or codes
Once these specific identifiers have been removed, the provider must have no actual knowledge that the remaining information could be used to identify the patient. If this “no actual knowledge” requirement has been satisfied, the PHI has been successfully de-identified under the safe harbor method.