Resource Explorer

For detailed information on the privacy rule and use of identifiable patient health information (PHI) for research visit this Health and Human Services (HHS) website.

The 18 personal identifiers defined by HIPAA are:

1. Name
2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes. NOTE: the initial three digits of the zip code are NOT considered an identifier IF, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same 3 initial digits contains more than 20,000 people and (2) The initial 3 digits of a zip code for all such geographic units containing 20,000 is changed to 000.
3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older. [This means you may record the year but not record the month or day of any date related to the subject if the subject is under the age of 89. In addition if the subject is over the age of 89 you may not record their age and you may not record the month, day or year of any date indicative of age (except that you may aggregate them into a category "Age>90" )]
4. Telephone numbers
5. Fax numbers
6. Electronic mail addresses
7. Social Security number
8. Medical Record number
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers, including license plate numbers
13. Device identifiers and serial numbers
14. Web Universal Resource Locators (URLs)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers, including finger and voice prints
17. Full face photographic images and any comparable images
18. Any other unique identifying number, characteristic, code that is derived from or related to information about the individual (e.g. initials, last 4 digits of Social Security #, mother's maiden name, first 3 letters of last name.)

Also not permitted: Any other information that could be used alone or in combination with other information to identify an individual (e.g. rare disease, study team or company has access to the health information and a HIPAA identifier or the key to the code).

If your research requires use of the above identifiers, it is likely that you will need Institutional Review Board (IRB) approval or documentation of exemption prior to initiating your project. Refer to this page for guidance on types of IRB review.

Please note that a Limited Data Set excludes most of the HIPAA identifiers listed above, EXCEPT for: city, zip code, and dates. Further information about Limited Data Sets can be found on the HHS website.