What are the 18 PHI identifiers that must be removed to consider data de-identified according to the HIPAA Privacy Rule?

Frequently Asked Questions

Types of Information that must be protected What are the 18 PHI identifiers that must be removed to consider data de-identified according to the HIPAA Privacy Rule? The 18 identifiers are listed below. Note it only takes one identifier for data to be considered as containing PHI. Name (includes initials) Street Address, City, State and Zip code Dates (birth, death, treatment, etc.) Phone FAX Email SSN Med. Rec. # Account # Health Plan Beneficiary # Certificate License # Vehicle ID (VIN) & Drivers License ID Device ID or Serial # Web URL IP Address Biometric IDs, including finger- or voice- prints Full-face photos or comparable images Any other unique ID #, characteristic or code. 5

Types of Information that must be protected

The 18 identifiers are listed below. Note it only takes one identifier for data to be considered as containing PHI.