HIPPA Identifiers to AVOID

18 HIPAA Identifiers that must be avoided

Names: Full names, initials, nicknames, or aliases.
Geography: Any subdivision smaller than a state (street address, city, county, ZIP code).
Dates: All elements except the year (birth, admission, discharge, death).
Phone Numbers: Home, mobile, or work numbers.
Fax Numbers: Personal or medical facility fax lines.
Email Addresses: Any personal or business email.
Social Security Numbers: Full or partial SSNs.
Medical Record Numbers (MRN): Hospital or provider-specific IDs.
Health Plan Beneficiary Numbers: Insurance member IDs.
Account Numbers: Banking, billing, or portal accounts.
Certificate/License Numbers: Driver’s licenses or professional credentials.
Vehicle Identifiers: License plates and VINs.
Device Identifiers: Serial numbers for medical equipment (e.g., pacemakers).
Web URLs: Links pointing to personal profiles or files.
IP Addresses: Unique internet protocol numbers.
Biometrics: Fingerprints, voice prints, or retinal scans.
Full-Face Photos: Or any comparable images that reveal a face.
Other Unique Codes: Any other unique identifying number, characteristic, or code. Loyola University Chicago +13

Designing banners for medical reminders requires following the "Minimum Necessary" standard. The goal is to provide value without revealing sensitive health information that could be seen by someone other than the patient.

❌ Unsafe Banners (HIPAA Violations)

These examples are dangerous because they include specific identifiers or sensitive clinical details that should never be sent via unencrypted email or displayed in an open notification.

Specific Diagnosis: "John, don't forget your Chemotherapy session tomorrow at 10 AM."
Specialty Clinics: "Reminder: Your appointment at the HIV/AIDS Wellness Center is scheduled for Friday."
Too Many Identifiers: "Hello Jane Doe (DOB: 05/12/85), you have a Colonoscopy with Dr. Smith at 123 Main St."
Clinical Results: "Your Lab Results for Blood Glucose are ready. Click here to view."

✅ Safe Banners (HIPAA Compliant)

These examples use generic language to protect the patient's privacy while still serving as a functional reminder.

Generic Appointment: "You have an upcoming appointment with Dr. Smith tomorrow at 10:00 AM."
Action-Oriented: "A new health message is waiting for you in your Secure Patient Portal."
Provider Only: "St. Jude Medical Group: You have a scheduled visit on Tuesday, April 20th."
Instructional: "Friendly reminder to fast for 12 hours before your appointment tomorrow morning."

More on HIPPA with Do's and Dont's

When creating banner reminders or automated messages, you must comply with the Health Insurance Portability and Accountability Act, commonly known as HIPAA. To do this, you must avoid exposing Protected Health Information in unencrypted or easily visible formats.

Here are the most important HIPAA identifiers to avoid in your public or unencrypted messages:
Patient names, whether full or partial.
Specific health conditions, diagnoses, or test results.
Specific treatment types or procedures, such as a root canal or physical therapy session.
Dates directly related to the individual, especially birth dates.
Unique identifying numbers, such as medical record numbers, account numbers, or Social Security numbers.
Any combination of information that could reasonably allow someone to identify the patient and their health status.

Here is a case study to demonstrate what to avoid and how to fix it.

THE DONT LIST AND EXAMPLE
Do not combine a patient's name with their specific treatment, condition, or detailed appointment type in an unencrypted message like an SMS, email subject line, or public banner.

Example of a HIPAA Violation:
Hi Jane Doe, this is a reminder for your cavity filling and teeth whitening appointment on Tuesday at 3:00 PM.

THE DO REVISION
Keep the message generic. Provide just enough information to remind the patient, and direct them to a secure portal or a phone call for the sensitive details.

HIPAA Compliant Revision:
Hello, this is a friendly reminder from your dental office regarding your upcoming appointment on Tuesday. Please call us or log in to your secure patient portal to confirm.

Here is a list of 10 HIPAA-compliant messages for your dental or medical banners and reminders:

1. This is a reminder that you have an upcoming appointment with our office. Please call us at your earliest convenience to confirm.
2. Friendly reminder from our clinic: You have an appointment scheduled for tomorrow. Please reply YES to confirm or call to reschedule.
3. It is time for your routine visit! Please contact our office to schedule your next appointment.
4. You have a new secure message available in your patient portal. Please log in to your account to view the details.
5. Reminder: Your recent lab results are ready. Please log in to your secure patient account to review them.
6. This is a courtesy reminder from your health care team regarding your scheduled visit. We look forward to seeing you.
7. Our records show you are due for your next check-up. Call us today to book your time.
8. Thank you for choosing our practice. Please remember to complete your pre-visit forms via your secure patient portal before arriving.
9. A quick reminder: Your appointment is coming up soon. Please remember to bring your photo ID and insurance card.
10. Your requested items are ready for pickup at our front desk. Please visit us during normal business hours.

Here are 10 more case studies showing a wrong message, the specific HIPAA violation, and the right way to send the message.

CASE STUDY 1
WRONG: John, your prescription for Prozac is ready for pickup.
VIOLATION: This violates HIPAA by combining the patient's first name with a specific medication, which reveals a mental health condition.
RIGHT: Hello, your requested prescription is ready for pickup at the pharmacy.

CASE STUDY 2
WRONG: Hi Sarah, your blood test results for diabetes came back normal.
VIOLATION: This exposes the patient's name, the specific test performed, and the medical condition being monitored.
RIGHT: Hello, your recent lab results are available. Please log in to your secure portal to view them.

CASE STUDY 3
WRONG: Mr. Smith, we have scheduled your referral appointment with the oncologist for next week.
VIOLATION: This links the patient's name to a specific type of specialist, which implies a cancer diagnosis to anyone who might see the message.
RIGHT: Hello, we have an update regarding your referral. Please call our office for the details.

CASE STUDY 4
WRONG: Hi Emily, this is a reminder for your post-op checkup following your breast augmentation.
VIOLATION: This combines the patient's name with a highly specific, sensitive, and private surgical procedure.
RIGHT: Hello, this is a reminder for your upcoming follow-up appointment. Please call if you need to reschedule.

CASE STUDY 5
WRONG: David, you have an outstanding balance of $200 for your sleep apnea treatment.
VIOLATION: This associates the patient's name with a specific medical treatment and billing information in an unencrypted channel.
RIGHT: Hello, there is an update regarding your account balance. Please log in to our secure billing portal or call us.

CASE STUDY 6
WRONG: Hi Lisa, just reminding you about your couples counseling session with Dr. Jones tomorrow at 4 PM.
VIOLATION: This reveals the patient's name and the specific nature of the mental health and counseling service she is receiving.
RIGHT: Hello, this is a reminder for your appointment tomorrow at 4 PM. Please reply YES to confirm.

CASE STUDY 7
WRONG: Michael, do not forget your appointment for your two dental implants and bone graft on Friday.
VIOLATION: This details exact, extensive dental surgical procedures alongside the patient's name.
RIGHT: Hello, this is a reminder from your dental office about your upcoming appointment on Friday.

CASE STUDY 8
WRONG: Reminder: Tommy's MMR and Varicella vaccines are due at his appointment tomorrow.
VIOLATION: This identifies a minor by name and lists the specific medical treatments and vaccines he is scheduled to receive.
RIGHT: Reminder: You have an upcoming pediatric appointment tomorrow. Please call us if you have any questions.

CASE STUDY 9
WRONG: Hi Jessica, your MRI results for your torn ACL are in. The doctor wants to discuss surgery.
VIOLATION: This exposes the patient's name, specific injury, imaging type, and future treatment plans.
RIGHT: Hello, the doctor has reviewed your recent imaging. Please call the clinic to schedule a follow-up discussion.

CASE STUDY 10
WRONG: Robert, your CPAP machine and supplies are ready to be picked up from our front desk.
VIOLATION: This links the patient to specific durable medical equipment, which reveals a sleep condition.
RIGHT: Hello, your requested supplies are ready for pickup at our front desk during normal business hours.