De-identified documents only

What information should I remove?

Appeal Builder is intended only for properly de-identified healthcare information. You are responsible for preparing and verifying your documents before you upload them.

De-identification is more than removing names. Before you upload, remove or replace everything that could identify the patient, directly or in combination with other information. HHS describes two accepted methods: Safe Harbor (remove the identifiers listed below and have no actual knowledge that what remains could identify the person) and Expert Determination (a qualified expert documents that the risk of identification is very small).

Identifiers to remove (Safe Harbor list, summarized)

Names (of the patient and of relatives, employers or household members)
Street addresses, cities, counties, precincts, ZIP codes and other geographic areas smaller than a state
All elements of dates (except year) directly related to the patient: birth, admission, discharge, service, evaluation and death dates
Ages over 89, and any date element showing such an age
Telephone and fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary, member and subscriber numbers
Account numbers (including authorization, claim and case numbers tied to the patient)
Certificate and license numbers
Vehicle identifiers and serial numbers, including license plates
Device identifiers and serial numbers
Web addresses (URLs) and IP addresses
Biometric identifiers, such as fingerprints and voiceprints
Full-face photographs and comparable images
Any other unique identifying number, characteristic or code

Check free-text narratives

Progress notes and histories often mention family members, employers, schools, teachers, towns, events in the news, or unusual circumstances (for example, a rare occupation or a widely known incident). Remove or generalize anything that could point to one person.

Check hidden content and metadata

Black boxes drawn over PDF text do not remove the text underneath. Also check Word comments, tracked changes, headers and footers, hidden text, file names and file properties (author, company). Appeal Builder does not send file names, properties, comments or images, but the text preview shows everything it would send, including text hidden under boxes.

Example replacements

Patient name	[PATIENT NAME]
Member number	[MEMBER ID]
Authorization number	[AUTHORIZATION NUMBER]
Date of birth	[DOB]
Street address	[ADDRESS]
Exact patient-related date	[DATE]
School name	[SCHOOL]
Other identifying details	[REDACTED]

These replacements are examples. They are not sufficient in every situation: a document can still identify someone through the combination of details that remain. Ages, years and general settings (such as “public school”) are usually acceptable; use professional judgment and your organization's privacy policies.

Source for the identifier list: U.S. Department of Health and Human Services, Office for Civil Rights, guidance on de-identification methods under the HIPAA Privacy Rule (45 CFR 164.514). This summary is not legal advice. If you are unsure whether a document is properly de-identified, do not upload it.