De-Identification

• A covered entity may determine that health information is not individually identifiable only if: … the following identifiers of the individual or of relatives, employers, or household members of the individual are removed:

• Names;

• All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, …, except for the initial three digits of a zip code if …

• All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89…

• Telephone numbers; Fax numbers; email addresses; URLs; IP addresses

• Social security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers;

• Certificate/license numbers; vehicle identifiers, serial numbers, plate numbers;

• Device identifiers and serial numbers;

• Biometric identifiers, including finger and voice prints;

• Full face photographic images and any comparable images; and

• Any other unique identifying number, characteristic, or code; and

• The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.

• 45 CFR §164.514

Notes: