Identifier

A code or element of a data that can be used to link research data to an individual. The HIPAA Privacy Rule standard for de-dentification specifies 18 direct identifiers, listed below, that makes a dataset identifiable:

1. Names
2. All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census:
   a. The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and
   b. the initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000.
3. All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
4. Telephone numbers
5. Vehicle identifiers and serial numbers, including license plate numbers
6. Fax numbers
7. Device identifiers and serial numbers
8. Email addresses
9. Web Universal Resource Locators (URLs)
10. Social security numbers
11. Internet Protocol (IP) addresses
12. Medical record numbers
13. Biometric identifiers, including finger and voice prints
14. Health plan beneficiary numbers
15. Full face photographic images and any comparable images
16. Account numbers
17. Any other unique identifying number, characteristic, or code (unless otherwise
    permitted by the Privacy Rule for re-identification)
18. Certificate/license numbers

HIPAA: Guidance Regarding Methods for De-identification of PHI in Accordance with the HIPAA Privacy Rule