The HCC may de-identify PHI on recipients by removing all
recipient identifiable information
45CFR
164.514(a)(b). Authorized
HCC employees shall forward the PHI to be deidentified to a person with
appropriate knowledge of and experience with generally accepted statistical and
scientific principles and methods for rendering information not individually
identifiable; or they shall remove all the following recipient identifiable
information.
A. Names.
B. Location: All geographic subdivisions
smaller than a state, including street address, city, county, precinct, zip
code, and their equivalent geocodes, except for the initial three digits of a
zip code if, according to the current publicly available data from the bureau
of the census:
(1) the geographic unit formed
by combining all zip codes with the same three initial digits contains more
than 20,000 people; and
(2) the
initial three digits of a zip code for all such geographic units containing
20,000 or fewer people is changed to 000.
C. Dates: All elements of dates (except year)
for dates directly related to an individual, including birth date, admission
date, discharge date, date of death; and all ages over 89 and all elements of
dates (including year) indicative of such age, except that such ages and
elements may be aggregated into a single category of age 90 or older;
D. Numbers: All elements of numbers, or
combination of alpha-numeric and special characters, for identification
directly related to an individual, including:
(1) telephone numbers;
(2) fax numbers;
(3) e-mail addresses;
(4) social security numbers;
(5) medical record numbers;
(6) health plan beneficiary
numbers;
(7) account
numbers;
(8) certificate/license
numbers;
(9) vehicle identifiers
and serial numbers, including license plate numbers;
(10) device identifiers and serial
numbers;
(11) web universal
resource locators; (URLs);
(12)
internet protocol (IP) address numbers;
(13) any other unique identifying number,
characteristic, or code, except as otherwise permitted.
E. Imagery: All elements of physical
characteristics captured in any format, or combination of formats, for
identification directly related to an individual, including:
(1) biometric identifiers, including finger
and voiceprints; and
(2) full face
photographic images and any comparable images.
