When developing research protocols, the Investigator must take into consideration allowable use and disclosure of PHI under HIPAA. The following identifiers are considered links to a particular individual or data that could enable individual identification:
- Names
- Geographic subdivisions smaller than a State, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of a ZIP code
- All elements of dates (except year) for dates directly related to an individual (e.g., date of birth, admission)
- Telephone numbers
- Fax numbers
- Electronic mail addresses
- Social security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers, including license plate numbers
- Device identifiers and serial numbers
- Web universal locators (URLs)
- Internet protocol (IP) address numbers
- Biometric identifiers, including finger and voiceprints
- Full-face photographic image and any comparable images
- Any other unique identifying number, characteristic, or code