Section 17. De-Identification Of Protected Health Information

The HCC may de- identify PHI on recipients by removing all recipient identifiable information 45CFR 164.514(a)(b). Authorized HCC employees shall forward the PHI to be de-identified to a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable; or they shall remove all the following recipient identifiable information. A. Names. B. Location: All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the bureau of the census: (1) the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. C. Dates: All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; 8.300.2 NMAC 13 D. Numbers: All elements of numbers, or combination of alpha-numeric and special characters, for identification directly related to an individual, including: (1) telephone numbers; (2) fax numbers; (3) e-mail addresses; (4) social security numbers; (5) medical record numbers; (6) health plan beneficiary numbers; (7) account numbers; (8) certificate/license numbers; (9) vehicle identifiers and serial numbers, including license plate numbers; (10) device identifiers and serial numbers; (11) web universal resource locators; (URLs); (12) internet protocol (IP) address numbers; (13) any other unique identifying number, characteristic, or code, except as otherwise permitted. E ) health plan beneficiary numbers; (7) account numbers; (8) certificate/license numbers; (9) vehicle identifiers and serial numbers, including license plate numbers; (10) device identifiers and serial numbers; (11) web universal resource locators; (URLs); (12) internet protocol (IP) address numbers; (13) any other unique identifying number, characteristic, or code, except as otherwise permitted. E. Imagery: All elements of physical characteristics captured in any format, or combination of formats, for identification directly related to an individual, including: (1) biometric identifiers, including finger and voiceprints; and (2) full face photographic images and any comparable images.