A Limited Data Request under the HIPAA Privacy Rule may not include:

• names;
• street addresses (other than town, city, state and zip code);
• telephone numbers;
• fax numbers;
• e-mail addresses;
• Social Security numbers;
• medical records numbers;
• health plan beneficiary numbers;
• account numbers;
• certificate license numbers;
• vehicle identifiers and serial numbers, including license plates;
• device identifiers and serial numbers;
• URLs;
• IP address numbers;
• biometric identifiers (including finger and voice prints); and
• full face photos (or comparable images).

The following items may be included in a Limited Data Request but would require the requestor to either obtain an individual’s authorization or an approval of a waiver of authorization.

• dates such as admission, discharge, service, DOB (date of birth), DOD (date of death);
• city, state, five digit or more zip code; and
• ages in years, months or days or hours

Source: http://www.hhs.gov/hipaa

Return to Data Information & Request Process main page