OtherEthics Feature

A Primer of the HIPAA Privacy Rule for Practice-Based Researchers

Anne Victoria Neale and Kendra L. Schwartz
The Journal of the American Board of Family Practice November 2004, 17 (6) 461-465; DOI: https://doi.org/10.3122/jabfm.17.6.461

Article Figures & Data

Tables

  • Table 1.

    Options for Conducting HIPAA-Compliant Practice-Based Research

    • HIPAA authorization by individuals to use their protected health information (PHI)

    • De-identified dataset that contains no PHI

    • Limited dataset with data use agreement

    • IRB waiver of HIPAA authorization

  • Table 2.

    The Privacy Rule Defines These as PHI Identifiers (6, 7)

    • Names

    • Geographic subdivisions smaller than a state if it contains less than 20, 000 people (the initial three digits of the zip code are allowed)

    • Dates: all elements of dates except year, and all ages over 89

    • Telephone numbers

    • Fax numbers

    • E-mail addresses

    • Social security numbers

    • Medical record numbers

    • Health plan beneficiary numbers

    • Account numbers

    • Certificate or license numbers

    • Vehicle identifiers and license plate numbers

    • Device identifiers and serial numbers

    • Internet URLs

    • Computer IP addresses

    • Biometric identifiers

    • Full-face photographs and comparable images

    • Any other unique identifying characteristic or code, except as permitted for re-identification

Back to top

In this issue

Print
Download PDF
Article Alerts
Email Article
Citation Tools

Jump to section