De-identified Information
lNames
lAll geographic subdivisions smaller than a state.
lAll dates (except year)
lTelephone numbers
lFax numbers
lElectronic mail addresses
lDevice identifiers and serial numbers
lWeb locators – URLs
lInternet Protocol address nos.
l
lSocial Security numbers
lMedical record numbers
lHealth plan beneficiary numbers
lAccount numbers
lCertificate/license numbers
lVehicle identifiers, including license plate numbers
lBiometric identifiers (finger and voice prints
lFull-face photographic images
lAny other unique identifying number or code
l
Authorization not required for disclosure of PHI that has been “de-identified” in one of two ways.
1) The CE could use a qualified expert to apply scientific criteria to determine that the risk of is very small that the information could be used to identify an individual. 2) Meet a “safe harbor” standard by stripping the health information of 18 enumerated identifiers.

Recognizing the limited value of de-identified information to researchers, HHS created a new category of information called the “limited data set”