What is a “de-identified data set”?

Using the “safe harbor” method, a de-identified data set excludes all 18 HIPAA identifiers:

  1. Name
  2. Address (all geographic subdivisions smaller than state, including street address, city county, and zip code)
  3. All elements (except years) of dates related to an individual (including birthdate, admission date, discharge date, date of death, and exact age if over 89)
  4. Telephone numbers
  5. Fax number
  6. Email address
  7. Social Security Number
  8. Medical record number
  9. Health plan beneficiary number
  10. Account number
  11. Certificate or license number
  12. Vehicle identifiers and serial numbers
  13. Device Identifiers and serial numbers
  14. Web URL
  15. Internet Protocol (IP) Address
  16. Biometric identifiers, including finger or voice print
  17. Photographic image - Photographic images are not limited to images of the face.
  18. Any other characteristic that could uniquely identify the individual