65192132_ted_to_Handling_Sensitive_Data__Examples
[Law/Regulation/ Standard] Electronic Protected health Information (ePHI) or HIPAA ePHI is regulated by the Health Insurance Portability and Accountability Act (HIPAA) [Definition] The Privacy and Security Rules apply only to covered entities in their role as a Health Care Provider, Health Plan, or Health Care Clearinghouse. Protected health information excludes individually identifiable health information in: Education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g(a)(4)(B)(iv) Employment records held by a covered entity in its role as an employer [Data Steward/ Manager] Health System Compliance Officer compliance-Group@med.umich.edu [Resources] U.S. Dept of Health HIPAA website Health and Human Services Information for Covered Entities UMHS Compliance ITS HIPAA-Aligned Services: What U-M Units Need to Know [Examples] 
The following individually identifiable data elements, when combined with health information about that individual, make such information protected health information (PHI): Names All geographic subdivisions smaller than a State All elements of dates (except year) for dates directly related to an individual including birth date, admission date, discharge date, date of death Telephone numbers Fax numbers Email addresses Social security numbers Medical record numbers Health plan beneficiary numbers Account numbers Certificate/License numbers Vehicle identifiers and serial numbers, including license plate numbers Device identifiers and serial numbers URLs IP addresses Biometric identifiers Full face photographic images and any comparable images and any other unique identifying number, characteristic, code, or combination that allows identification of an individual. See the Sensitive Data Guide: Protected Health Information (HIPAA) for more examples.
University of Michigan | ITS | Safe Computing | Information Security Laws and Regulations Related to Handling Sensitive Data
Examples