HIPAA Glossary

Hospital personnel must get a signed, written Authorization from the patient in order to use or disclose PHI for purposes other than Treatment, Payment or Healthcare Operations (TPO). Authorizations would be needed, for example, for some types of research and for contacting our patients for marketing or fund raising.

Each Authorization must include, among other things:

• A description of the PHI to be used or disclosed.
• The persons or classes of persons authorized to use or disclose the information.
• A list of those who would receive the PHI.
• A description of the purpose of each Use or Disclosure of the PHI.
• Expiration date or event.
• Signature of the patient or his or her representative.

Coded data and specimens are defined by OHRP as meaning:

1. identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and
2. a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens. See the page on

Some PHI elements may remain in the dataset if required for the research. Typically this might include the elements permitted in a limited data set.

Deidentified datasets are those (1) without any elements of PHI and (2) without a way for the investigator/recipient to relink the data back to PHI. The elements of PHI from the individual, relatives of the individual, employers or household members of the individual that must be excluded for the dataset to be considered deidentified include:

• Names
• All geographic subdivisions smaller than a State, including street address, city^*, county^*, precinct^*, zip code^* and their equivalent geocode (except the initial 3 digits of a zip code)
• All elements of dates^* (except Year), including date of birth, date of admission, or date of visit / service
• Telephone numbers
• Fax numbers
• Electronic mail addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identification numbers and serial numbers, including license plate numbers
• Device identifiers (e.g. implanted medical devices) and serial numbers
• Web URLs
• Internet protocol (IP) address numbers
• Biometric indicators, including finger and voice prints
• Full face photographic images and any comparable images
• Any other unique identifying number, characteristic, or code except as permitted above provided the investigator could not use the information alone or in combination with other information to identify an individual who is a subject of the information.

^* These items may be included in a Limited Data Set.

A limited data set is protected health information (PHI) that excludes certain PHI. A limited data must exclude the same PHI as required for a Deidentified data set except for the following: some postal address information (city, state, ZIP Code); elements of date; and other numbers, characteristics, or codes not listed as direct identifiers. A limited dataset may be used or disclosed, for purposes of research, public health, or health care operations, without obtaining either an individual's Authorization or a waiver or an alteration of Authorization for its Use and Disclosure, provided the provider and the recipient have executed a Data Use Agreement.

Creating a Limited Data Set:

Delete/remove all elements of PHI from the data that would be required to created a Deidentified data set with the exception of the following items:

• Postal address information other than town, or city, State and zip code
• Dates including date of birth, date of admission, date of visit, or date of service