Answer: Patient condition: improved breathing with new medication
Explanation: De-identified information (that is, information stripped of data that may identify an individual) isn’t covered by the Privacy Rule—provided the healthcare provider doesn’t have actual knowledge that even after stripping it of identifiers, the information could be used alone or in combination with other information to identify the patient [45 CFR 164.502(d)]. In other words, the de-identified information can’t contain something unique that would allow it to be linked to a specific patient. For example, suppose a man survives a serious car accident because of the heroism of a doctor on call in the emergency room. Because this story was reported by news media, information about his case may be able to identify him as the man in the accident, even if identifying information is removed from his record.
Under the Privacy Rule, the following factors are labeled as individual identifiers [45 CFR 164.514(b)(2)(i)]:
• Names
• Geographic identifiers smaller than a state,
like a county or ZIP code
• Dates (except year) Ages greater than 89
• Phone numbers
• Fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate and license numbers
• Vehicle identifiers and serial numbers,
including license plate numbers
• Medical device identifiers and serial
numbers
• URLs and Internet protocol (IP) addresses
• Biometric identifiers, including fingerprints
and voiceprint
• Full-face photographs
• Any other unique identifiers
