Health information is considered de-identified if it cannot be used to identify an individual. Other terms for de-identified health information are aggregated and scrubbed.
The Privacy Rule details the specific patient information that must be removed from PHI to qualify as de-identified. Some examples include:
- Names
- Dates, such as birthdays
- Geographic locations more specific than states
- Telephone numbers
- Social Security numbers
- Medical record numbers
- Full-face photos or comparable images
When PHI is de-identified, it is no longer considered protected. De-identified health information should be used whenever patient identification is unnecessary.
