Table 2.

The Privacy Rule Defines These as PHI Identifiers (6, 7)

  • Names

  • Geographic subdivisions smaller than a state if it contains less than 20, 000 people (the initial three digits of the zip code are allowed)

  • Dates: all elements of dates except year, and all ages over 89

  • Telephone numbers

  • Fax numbers

  • E-mail addresses

  • Social security numbers

  • Medical record numbers

  • Health plan beneficiary numbers

  • Account numbers

  • Certificate or license numbers

  • Vehicle identifiers and license plate numbers

  • Device identifiers and serial numbers

  • Internet URLs

  • Computer IP addresses

  • Biometric identifiers

  • Full-face photographs and comparable images

  • Any other unique identifying characteristic or code, except as permitted for re-identification