Potential identifiers include obvious ones like name and social security number, and also:

• All geographic subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and [t]he initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
• All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
• Voice and fax telephone numbers;
• Electronic mail addresses;
• Medical record numbers, health plan beneficiary numbers, or other health plan account numbers;
• Certificate/license numbers;
• Vehicle identifiers and serial numbers, including license plate numbers;
• Device identifiers and serial numbers
• Internet Protocol (IP) address numbers and Universal Resource Locators (URLs);
• Biometric identifiers, including finger and voice prints;
• Full face photographic images and any comparable images; and
• Any other unique identifying number, characteristic, or code.

Under HIPAA's "safe harbor" standard, information is considered de-identified if all of the above have been removed, and there is no reasonable basis to believe that the remaining information could be used to identify a person.