• Databases • Formal and informal discussions o The identifiers included in PHI of the individual, his or her relatives, employers, or household members that can be used or disclosed without authorization for purposes of research, public health, or healthcare operations as long as there are limits placed on its use are: • Name • Postal address information other than town/city, state, and zip code • Telephone number • Fax number • Electronic mail (email) address • Social security number • Medical record number • Health plan beneficiary number • Account number • Certificate/license number • Vehicle identifiers and serial numbers, including license plate numbers • Web Universal Resource Locators (URLs) • Internet Protocol (IP) address numbers • Biometric identifiers, such as fingerprints or voice prints • Full face photographs or other comparable images o The Agency must ensure that its staff protects PHI in all settings and at all times. Staff should not discuss patients/clients while in public places, patients’/clients’ names should not be announced over the intercom, whiteboards should not be in public places, etc. Patient/client information should not be discussed at home. • Security Rule o The Security Rule adopts standards for the security of electronic health information to assure the confidentiality of electronic protected health information (ePHI). It includes: • Administrative procedures to guard data integrity, confidentiality, and availability, such as:
