A Limited Data Request under the HIPAA Privacy Rule may not include:
- names;
- street addresses (other than town, city, state and zip code);
- telephone numbers;
- fax numbers;
- e-mail addresses;
- Social Security numbers;
- medical records numbers;
- health plan beneficiary numbers;
- account numbers;
- certificate license numbers;
- vehicle identifiers and serial numbers, including license plates;
- device identifiers and serial numbers;
- URLs;
- IP address numbers;
- biometric identifiers (including finger and voice prints); and
- full face photos (or comparable images).
The following items may be included in a Limited Data Request but would require the requestor to either obtain an individual’s authorization or an approval of a waiver of authorization.
- dates such as admission, discharge, service, DOB (date of birth), DOD (date of death);
- city, state, five digit or more zip code; and
- ages in years, months or days or hours
Source: http://www.hhs.gov/hipaa
