Frequently Asked Questions

What are the 18 PHI identifiers that must be removed to consider data de-identified according to the HIPAA Privacy Rule?

The 18 identifiers are listed below. Note it only takes one identifier for data to be considered as containing PHI.

• Name (includes initials)
• Street Address, City, State and Zip code
• Dates (birth, death, treatment, etc.)
• Phone
• FAX
• Email
• SSN
• Med. Rec. #
• Account #
• Health Plan Beneficiary #
• Certificate License #
• Vehicle ID (VIN) & Drivers License ID
• Device ID or Serial #
• Web URL
• IP Address
• Biometric IDs, including finger- or voice- prints
• Full-face photos or comparable images
• Any other unique ID #, characteristic or code.