Information about the past, present, or future physical or mental health of an individual that identifies or could be used to identify the individual and is created or received by a Covered Entity. (45 CFR 160.301, 164.501; information about the provision of health care and payment for health care is included; some educational and employment records are excluded.)

Individually identifiable health information that is covered under HIPAA consisting of the following:

• Names;
• Geographic subdivisions smaller than a state;
• All elements of dates except year (including birth, admission and discharge dates; date of death; and individuals over 89 years old);
• The following categories of numbers: telephone and fax, social security, medical record, health plan beneficiary, account, certificate and license numbers;
• Electronic mail (e-mail) and internet protocol (IP) addresses;
• Internet universal resource locators (URLs);
• Vehicle and device identifiers and serial numbers;
• Biometric identifiers (e.g., finger and voice prints);
• Full-face photographic or comparable images; and
• Any other unique identifying number, characteristic or code.