18 PHI Identifiers in a Therapy Record: Examples and De-Identification Limits
Outline
| Identifier | Example in a therapy record | Where it hides |
|---|---|---|
| Names | “Jordan Lee” in a client header or quoted disclosure | Intake form, progress note, email, filename |
| Geographic data smaller than a state | A street address, ZIP code, or neighborhood named in a housing note | Demographics, intake, case narrative |
| Dates tied to a person | Date of birth, admission date, discharge date, or session date | Header, appointment log, exported note |
| Telephone numbers | Client mobile number in a safety-plan section | Intake, contact card, text-message export |
The table above is the first scan of the 18 HIPAA identifiers. This phi identifiers checklist is designed for a therapy record, where a name may disappear while a date, message, or rare event still points to one client. Keep it beside your release, export, or data-sharing workflow, then continue through the remaining categories below. The legal list appears in 45 CFR 164.514(b)(2); examples here are written for therapy records and do not replace the regulation.
How to use the phi identifiers scan
Start with the record as a recipient will receive it, not only the screen you normally use. Include the note body, header, appointment history, attachments, filenames, audit export, portal messages, and metadata that travels with the file. Search structured fields first, then read free text for combinations that could point to one client. The phi identifiers review is strongest when it covers the whole export rather than only the visible note.
A de-identification pass answers two different questions:
- What direct identifiers did you remove or replace? These are obvious fields such as a name, phone number, or email address.
- What context could still identify the person? A rare event, exact date, small town, employer, family relationship, or distinctive quotation may identify a client even after direct fields are gone.
Do not call a redacted chart anonymous merely because the name is gone. Under the HIPAA Privacy Rule, the safe-harbor method requires removal of the listed identifiers and no actual knowledge that the remaining information could identify the individual. The expert-determination method is a separate route described in the same regulation and requires an appropriately qualified expert’s determination.
Identifiers 1 through 4
The first group is easy to spot in an intake or note header, but it also appears in copied-forward text and exported filenames.
Names
Identifier: Names of the client, family member, caregiver, or other household member.
Example in a therapy record: “Jordan Lee reported that Jordan’s sister called after the appointment.”
Where it hides: Note headers, signed forms, referral letters, quoted messages, and filenames such as Jordan-Lee-intake.pdf.
Replace the name consistently across the record copy. Check references to other people too; a relative’s name can identify the client through the relationship.
Geographic subdivisions smaller than a state
Identifier: Street address, city, county, precinct, ZIP code, or other geographic subdivision smaller than a state, subject to the regulation’s specific treatment of initial ZIP digits.
Example in a therapy record: “Client moved from 14 Oak Street in the Riverbend neighborhood to a shelter in the same county.”
Where it hides: Address fields, housing history, school or employer details, referral notes, and narrative descriptions of local events.
Do not infer that a city is harmless because it is familiar. Small-area geography combined with a rare clinical event can narrow the person quickly.
Dates directly related to an individual
Identifier: Dates other than year that relate to the individual, including birth, admission, discharge, death, and service dates, as defined by the regulation. For ages over 89, all ages and all elements of dates (including the year) indicative of those ages must be removed; those ages and elements may be aggregated into a single category of age 90 or older (45 CFR 164.514(b)(2)(i)(C)).
Example in a therapy record: “The client attended the intake on October 7, 2026, and disclosed a crisis on September 29.”
Where it hides: Appointment history, note timestamps, treatment-plan review dates, scanned forms, and filenames.
For a de-identified dataset, apply the method consistently rather than casually changing one date. Preserve only the level of time detail the approved purpose needs.
Telephone numbers
Identifier: Home, mobile, work, emergency-contact, and other telephone numbers.
Example in a therapy record: “Call the client at 555-0184 if the telehealth link fails.”
Where it hides: Demographics, safety plans, reminder logs, billing contacts, and message exports.
Scan emergency contacts and caregiver fields as well as the client’s own number. A phone number in a free-text plan remains an identifier even when the contact table is removed.
Identifiers 5 through 8
These categories often travel through digital workflows that clinicians do not see in the rendered note.
| Identifier | Example in a therapy record | Where it hides |
|---|---|---|
| Fax numbers | A referral fax number tied to the client’s home or workplace | Referral cover sheet, scanned intake |
| Email addresses | jordan.lee@example.com in a portal message | Message thread, export, scheduling record |
| Social Security numbers | A partially copied SSN in an insurance intake field | Billing form, scanned document, claim attachment |
| Medical record numbers | Internal chart ID MRN-004281 | EHR header, export filename, claim file |
Fax numbers
Identifier: Fax numbers, including a personal fax line or a number that identifies a small practice or household in context.
Example in a therapy record: “Send the signed release to the client’s home fax at 555-0199.”
Where it hides: Referral packets, release-of-information forms, cover pages, and scanned correspondence.
Review image-based documents with OCR or visual inspection. A fax number may never appear in searchable note text.
Email addresses
Identifier: Email addresses.
Example in a therapy record: “The client requested the worksheet at jordan.lee@example.com.”
Where it hides: Portal messages, appointment reminders, consent forms, and mail headers.
Remove addresses from both visible content and exported message metadata. Do not substitute a realistic address that could belong to another person.
Social Security numbers
Identifier: Social Security numbers.
Example in a therapy record: An insurance intake PDF includes the client’s SSN for an eligibility check.
Where it hides: Billing intake, scanned insurance cards, payer correspondence, and document properties.
A partial number can still be sensitive and identifying in context. Keep it out of training, test, and analytics copies unless the approved purpose specifically requires it.
Medical record numbers
Identifier: Medical record, chart, case, or other identifying numbers assigned to the individual.
Example in a therapy record: “MRN-004281: review the release before sending the discharge summary.”
Where it hides: EHR headers, claim exports, filenames, barcodes, and audit logs.
A replacement token is still an identifier if the recipient or a linked key can use it to identify the client. Separate a re-identification key from the working dataset and restrict access.
Identifiers 9 through 12
The next group includes account and device details that are common in billing, telehealth, and connected-app exports.
| Identifier | Example in a therapy record | Where it hides |
|---|---|---|
| Health-plan beneficiary numbers | Member ID from a payer card | Insurance form, claim, eligibility response |
| Account numbers | A billing account or client portal account number | Billing ledger, portal export |
| Certificate or license numbers | A client’s certificate number or a household member’s license number in a signed record | Intake form, referral attachment, signature block |
| Vehicle identifiers and serial numbers | A license plate mentioned in a transportation-safety note | Intake narrative, incident attachment |
Health-plan beneficiary numbers
Identifier: Health-plan beneficiary numbers.
Example in a therapy record: “Verify member ID HJ44218 before submitting the claim.”
Where it hides: Insurance cards, eligibility responses, claims, and billing notes.
Do not assume that a payer member ID is harmless because it belongs to the plan. It identifies the covered person in the payer’s system.
Account numbers
Identifier: Account numbers assigned to a client or their health-care account.
Example in a therapy record: “The portal account 883104 is locked after three failed logins.”
Where it hides: EHR exports, payment records, portal support tickets, and filenames.
Check both clinical and administrative systems. A record can contain an account number even when the clinical note does not.
Certificate and license numbers
Identifier: Certificate or license numbers of the individual, a relative, employer, or household member.
Example in a therapy record: A signed intake form includes a household member’s driver’s-license number next to the client’s case details.
Where it hides: Referral forms, credentialing attachments, signed PDFs, and practice-management exports.
The safe-harbor category is about the individual and the individual’s relatives, employers, or household members. A clinician’s license number may still need review for another reason, but it is not automatically one of the client’s 18 identifiers merely because it appears beside the case.
Vehicle identifiers and serial numbers
Identifier: Vehicle identifiers and serial numbers, including license plate numbers.
Example in a therapy record: “Client’s safety plan includes the plate number of the vehicle used for transportation.”
Where it hides: Safety plans, incident reports, scanned forms, and narrative disclosures.
Identifiers 13 through 16
These identifiers are easy to miss because they may appear in technical or clinical context rather than the client-demographic section.
| Identifier | Example in a therapy record | Where it hides |
|---|---|---|
| Device identifiers and serial numbers | A telehealth tablet serial number linked to one client | Device log, support ticket |
| Web URLs | A client-specific portal or shared-document URL | Message, note, browser export |
| IP addresses | IP address recorded during a telehealth login | Access log, security export |
| Biometric identifiers | Voiceprint or face geometry used for access | Authentication record, media system |
Device identifiers and serial numbers
Identifier: Device identifiers and serial numbers.
Example in a therapy record: “Tablet serial number ES-8841 was assigned to the client’s remote-session kit.”
Where it hides: Device management, telehealth support, inventory records, and integration logs.
Look beyond cars: a serial number for a monitored device, phone, or other item can identify a client when linked to that client. If the device identifier can be linked to the client, treat that link as part of the data review. Deleting it from the note does not delete it from the export.
Web URLs
Identifier: Web URLs that relate to the individual or provide access to their information.
Example in a therapy record: A private portal URL contains a client token that opens the client’s appointment page.
Where it hides: Messages, care-plan links, shared documents, QR codes, and browser history exports.
Remove or invalidate client-specific URLs. A URL can expose information even when it contains no readable name.
Internet Protocol addresses
Identifier: IP addresses.
Example in a therapy record: A telehealth access log records the client’s home IP address at the time of a session.
Where it hides: Telehealth logs, security reports, event exports, and support tickets.
Technical logs are part of the review scope when they accompany the record. Do not treat them as outside the clinical dataset just because the clinician does not see them in the note.
Biometric identifiers
Identifier: Biometric identifiers, including fingerprints, voiceprints, and retinal or iris scans.
Example in a therapy record: A voiceprint is stored for a client using voice-based portal authentication.
Where it hides: Authentication service, telehealth platform, access-control system, and media archive.
A recording can carry more than a biometric identifier. Review the audio or video itself, along with any derived voice or face profile.
Identifiers 17 and 18
The final two categories cover images and other unique identifying characteristics that do not fit neatly in a demographic field.
| Identifier | Example in a therapy record | Where it hides |
|---|---|---|
| Full-face photographs and comparable images | A photo attached to an intake or identity-verification record | Media attachment, scanned ID, profile image |
| Any other unique identifying characteristic or code | A rare case code or unmistakable combination of facts | Free text, custom fields, research export |
Full-face photographs and comparable images
Identifier: Full-face photographic images and comparable images.
Example in a therapy record: A client uploads a full-face photo to verify identity for a remote intake.
Where it hides: Intake attachments, identity-verification service, profile image, and scanned identification.
Cropping out a name does not necessarily make a face image de-identified. Remove or transform the image under the approved method, and review thumbnails and cached copies.
Any other unique identifying characteristic or code
Identifier: Any other unique identifying characteristic or code.
Example in a therapy record: “The only client in the county who survived the February ferry accident” appears in a case narrative, or a custom code maps directly to one named client.
Where it hides: Free-text notes, case summaries, custom fields, rare-event narratives, and linked lookup tables.
This is the category that catches what a fixed checklist cannot. Read the complete record as a recipient would. A rare occupation, unusual family structure, distinctive event, or combination of ordinary facts can identify a person even when all obvious fields are gone.
Filled scan example
What removing the 18 identifiers does and does not achieve
Removing the listed identifiers can support the HIPAA safe-harbor method when you also meet the regulation’s no-actual-knowledge condition. It does not automatically make a record safe for every use, erase contractual restrictions, or remove the need to control access to the remaining data. Keep the phi identifiers decision with the approved purpose and reviewer evidence.
Keep these boundaries visible in your workflow:
- It does not make a clinical record anonymous by default. Indirect clues and unique characteristics can remain.
- It does not authorize every disclosure. Purpose, permissions, contracts, state law, and organizational policy still matter.
- It does not cover hidden copies automatically. Check backups, attachments, logs, thumbnails, exports, and vendor systems.
- It does not replace expert determination when the safe-harbor path is not appropriate. The regulation describes expert determination as a separate method.
- It does not turn a re-identifiable dataset into an unrestricted dataset. Keep keys, access rules, and approved uses documented.
For a practice-level review, compare this phi identifiers scan with the HIPAA compliance guide for solo practitioners, keep incident response with the HIPAA breach notification guide, and separate permission to disclose from the identifier scan with the HIPAA authorization guide.
A copy-ready identifier review
Use this phi identifiers worksheet before a test export, analytics handoff, research preparation, or vendor transfer. If the record includes psychotherapy notes, substance-use treatment information, genetic information, or state-law protected details, route the question through the practice’s privacy and legal review rather than relying on the 18-category scan alone.
How Emosapien supports the review workflow
Emosapien can help you organize note fields, access controls, and audit evidence, but the clinician or privacy lead remains responsible for deciding whether a record may be shared and which de-identification method applies. Use the HIPAA compliance resources to keep the policy, authorization, and breach-response pieces together.
Review PHI before sharing
Draft a structured note while you check identifiers and document the final sharing decision.
Draft privacy note →- Free plan
- No credit card
Checklist
Names are removed; dates, locations, filenames, and rare events still need review.
Privacy note draft
Draft the privacy note; check identifiers, document the method, and decide whether to share.
Educational resource for US mental-health clinicians. This page is not legal advice and does not certify that any dataset is de-identified or that a disclosure is permitted. Read the current regulation and obtain the review your practice needs before sharing protected health information.
References
- U.S. Department of Health and Human Services. (n.d.). 45 CFR 164.514—Other requirements relating to uses and disclosures of protected health information. 45 CFR 164.514