Health information is considered de-identified if it cannot be used to identify an individual. Other terms for de-identified health information are aggregated, and scrubbed.
The Privacy Rule details the specific patient information that needs to be removed from PHI for it to qualify as de-identified. Some examples include:
- Names
- Dates, such as birthdays
- Geographic locations more specific than states
- Telephone numbers
- Social security numbers
- Medical record numbers
- Full face photos or comparable images
When PHI is de-identified, it is no longer considered protected. De-identified health information should be used whenever patient identification is unnecessary.
