Part B Insider (Multispecialty) Coding Alert

Clip and Save:

Be Aware of These 18 PHI Identifiers

Published on Fri Nov 15, 2019

PDF

Remember, IP addresses constitute PHI.

With data breaches on the rise, it’s become even more challenging to protect patients’ privacy. And that’s why it’s critical that you and your staff know the HIPAA basics to sidestep a violation. More importantly, to safeguard patients’ privacy and keep your organization secure, you must recognize what constitutes protected health information (PHI).

Definition: PHI is best defined as “all ‘individually identifiable health information’ held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral,” reminds the HHS Office for Civil Rights (OCR) in its Privacy Rule guidance.

HIPAA Privacy Rule violations come in all shapes and sizes, from postcard snafus to missent text messages to social media mishaps. And that’s why it’s a good idea to know exactly what “individually identifiable health information” refers to.

Here are 18 things that the HIPAA Privacy Rule identifies as PHI:

Name
Address
Birthdate and other corresponding dates of admission, discharge, death, etc.
Landline and cellphone numbers
Fax numbers
Email addresses
Social Security Number
Medical record number
Health plan beneficiary number (i.e. Medicare Beneficiary Identifier)
Account number
State identification or license number
Vehicle identifiers and serial numbers, including license plate numbers
Device identifiers and serial numbers
URLs
IP addresses
Biometric identifiers like finger or voice prints
Photo or image of patient, specifically the face
Any other unique code, characteristic, image, or number that identifies the individual

Reminder: If one of these 18 identifiers is included in a chat, an email, a social media post, a text, or any other kind of communication, you are revealing “identifiable” information. However, remember, OCR does not restrict the use and disclosure of “de-identified” health information.

Why? According to OCR guidance, “de-identified health information neither identifies nor provides a reasonable basis to identify an individual,” and it’s often passed two criteria. First, it’s been verified by a “qualified statistician”; and second, all “specified identifiers” have been removed, including employer and family information, and a covered entity (CE) deems the material stripped of identifiable PHI, indicates OCR.

Find the Privacy Rule summary and more in-depth details on the identifiers and de-identification at www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html.