What Are the 18 Protected Health Information Identifiers
Protected Health Information (PHI) is any data that could identify a patient and relates to their health status, treatment, or payment for care. Under the Health Insurance Portability and Accountability Act (HIPAA), PHI must be safeguarded to protect patient privacy. The list of PHI identifiers outlines the specific data elements that qualify as protected when linked to an individual. Understanding these identifiers helps healthcare entities, researchers, and business associates stay compliant and avoid data breaches.
The 18 Protected Health Information Identifiers
HIPAA defines 18 identifiers that render information as PHI when they can be used to identify an individual. The following list covers each item and clarifies how it can appear in records or communications.
- Names — Full names or any combination that can identify a person.
- All Geographic Subdivisions Smaller than a state, with the exception of the initial three digits of a ZIP code in many cases.
- All Elements Of Dates Directly related to an individual, excluding year, such as birth dates, admission dates, discharge dates, and service dates.
- Phone Numbers Personal contact numbers.
- Fax Numbers Fax contact details linked to a patient.
- Email Addresses Personal or work email addresses.
- Social Security Numbers A unique national identifier.
- Medical Record Numbers Identifiers assigned by a healthcare provider.
- Health Plan Beneficiary Numbers Numbers used by health plans to identify beneficiaries.
- Account Numbers Financial or billing account identifiers associated with a patient.
- Certificate Or License Numbers Professional licenses or certification numbers tied to an individual.
- Vehicle Identifiers And Serial Numbers Vehicle identifiers that could be linked to a person.
- Device Identifiers And Serial Numbers Serial numbers of medical devices or equipment used by a patient.
- Biometric Identifiers Fingerprints, voice prints, iris scans, and other biometric data.
- Full-Face Photographic Images Clear facial images or other recognizable photos.
- Any Other Unique Identifying Number, Characteristic, Or Code Any data element that could uniquely identify an individual when linked to health information.
Identifying information elevates the risk of privacy breaches. Even seemingly minor data elements can become PHI when combined with health information. Covered entities must implement administrative, physical, and technical safeguards to protect PHI, including access controls, encryption, and secure data handling practices. Noncompliance can result in penalties, loss of trust, and harm to patients.
- Minimize Data Collect only the PHI necessary for a specific purpose and limit data exposure across systems.
- De-Identification And Anonymization Use de-identified data for research or analytics when possible, following accepted frameworks and expert guidance.
- Access Controls Implement role-based access, strong authentication, and audit trails to monitor who views PHI.
- Data Encryption Encrypt data at rest and in transit to mitigate interception risks.
- Secure Communication Use approved channels for sharing PHI, such as secure email portals or encrypted file transfers.
- Training And Awareness Regularly educate staff on PHI risks, proper handling, and incident reporting.
- Incident Response Develop and test a response plan for potential PHI breaches, including notification procedures.
- Vendor Management Ensure business associates comply with PHI safeguards and have appropriate agreements in place.
- Patient Records PHI appears in electronic health records (EHRs), lab results, and imaging reports.
- Insurance Communications Benefits information, eligibility checks, and claims often contain PHI identifiers.
- Research Data Researchers may access PHI identifiers; de-identification is essential unless explicit patient consent is obtained.
- Healthcare Portals Patient login details and health information are potential PHI exposure points.
PHI rules evolve with technology and policy updates. Organizations should monitor HIPAA guidance, state privacy laws, and cybersecurity best practices. Regular audits, risk assessments, and staff training help maintain a resilient approach to protecting PHI identifiers.