Table 1: Essential Metadata that must be removed from images anonymized to the HIPAA standard.

1. Names

2. Geographic subdivisions smaller than a state, including address, city, county, precinct, ZIP, and their equivalent geocodes, except for initial three digits of ZIP code

3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older

4. Telephone numbers

5. Fax numbers

6. E-mail addresses

7. Social Security numbers

8. Medical record numbers

9. Health plan beneficiary numbers

10. Account numbers

11. Certificate/license numbers

12. Vehicle identifiers and serial numbers, including license plate numbers

13. Device identifiers and serial numbers

14. Web universal locators (URLs)

15. IP address numbers

16. Biometric identifiers, including fingerprints and voice prints

17. Full-face photographic images and any comparable images

18. Other unique identifying numbers, characteristics or codes