Under the US Health Insurance Portability and Accountability Act (HIPAA), PHI that is linked based
on the following list of 18 identifiers must be treated with special care: 1 Names. 2 All
geographical identifiers smaller than a state. 3 Dates (other than year). 4 Phone numbers. 5 Fax
numbers. 6 Email addresses. 7 Social Security numbers. 8 Medical record numbers. 9 Health insurance
beneficiary numbers. 10 Account numbers. 11 Certificate/license numbers. 12 Vehicle identifiers and
serial numbers, including license plate numbers. 13 Device identifiers and serial numbers. 14 Web
Uniform Resource Locators (URLs). 15 Internet Protocol (IP) address numbers. 16 Biometric
identifiers, including finger, retinal and voice prints. 17 Full face photographic images and any
comparable images. 18 Any other unique identifying number, characteristic, or code except the unique
code assigned by the investigator to code the data.