Topics Map > Guidance
Identifiability and the Common Rule: Guidance
Identifiability & the Common Rule: An identifier includes any information that could be used to link research data with an individual subject.
Version Date: July 30, 2012
- The Common Rule defines individually identifiable as the identity of the subject is, or may be, readily ascertained by the investigator or associated with the information.
- E.g., initials, address, zip code, phone number, gender, age, birth date, occupation, employer, racial or ethnic group, type of biopsy performed, date sample taken, diagnosis, primary care physician, referring physician, and genealogy.
- Age, ethnicity/race, gender if fewer than 5 individuals possess a particular cluster of traits
- Some of the identifiers listed above become less problematic if the sample size is large enough so that the potential identifiers could describe several individuals and thus cannot be linked to only one person. Conversely, if the sample size is small, the potential to identify an individual may increase, even in the absence of direct identifiers.
- Data may be identifiable if a combination of variables could potentially identify a subject.
HIPAA Privacy Rule Identifiers: 18 identifiers specified, most of which are demographic
- geographic subdivisions smaller than a state
- all elements of dates (except year) related to an individual (including dates of admission, discharge, birth, death and, for individuals over 89 years old, the year of birth must not be used)
- telephone numbers
- FAX numbers
- electronic mail addresses
- Social Security numbers
- medical record numbers
- health plan beneficiary numbers
- account numbers
- certificate/license numbers
- vehicle identifiers and serial numbers including license plates
- device identifiers and serial numbers
- web URLs
- internet protocol addresses
- biometric identifiers (including finger and voice prints)
- full face photos and comparable images