HIPAA Identifiers

HIPAA recognizes certain types of information that can be used to identify a specific person.

Health information that includes one or more of these identifiers may be considered Protected Health Information (PHI) when held by a person or organization subject to HIPAA.

These identifiers may relate to the individual who is the subject of the health information, as well as their relatives, employers, or household members.

The HIPAA Privacy Rule specifies 18 categories of identifiers:

  1. Names
  2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code
  3. All elements of dates (except for year) directly related to an individual and/or any indication that an individual is a specific age over 89 (a general category of “90 or older” is not an identifier)
    1. Examples include birth date, admission/discharge date, date of a procedure, and date of death, among others.
  4. Telephone numbers
  5. Fax numbers
  6. Email addresses
  7. Social security numbers
  8. Medical record numbers
  9. Health plan beneficiary numbers
  10. Account numbers
  11. Certificate/license numbers
  12. Vehicle identifiers and serial numbers, including license plate numbers
  13. Device identifiers and serial numbers
  14. Web Universal Resource Locators (URLs)
  15. Internet Protocol (IP) address numbers
  16. Biometric identifiers, including finger and voice prints
  17. Any image that captures an identifiable feature (e.g. facial features, tattoos, other unique characteristics)
  18. Any other unique identifying number, characteristic, or code
    1. This does not include randomly generated codes assigned by a researcher to identify study records when the means for reidentification are not disclosed outside the study team, not used for any purpose other than re-identification, and stored separately from the coded data.
Report a HIPAA Incident