HIPAA Guidelines for Fieldwork

Per HIPAA guidelines, students cannot report this information in fieldwork assignments such as case studies presentations:

  • Name
  • Location - includes anything smaller than a state, such as street address
  • Dates - all, including date of birth, admission and discharge dates
  • Telephone numbers
  • Fax numbers
  • Electronic e-mail addresses
  • Social security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate and/or license numbers
  • Vehicle identification numbers and license plate numbers
  • Device identifiers and their serial numbers
  • Web Universal Resource Locators (URLs)
  • Internet Protocol (IP) address numbers
  • Biometric identifiers, including finger and voice prints
  • Full face photographic images and any comparable images
  • Any other unique identifying number, characteristic, or code.

For written reports, the following information can be shared:

  • Age (age 90 and over must be aggregated to prevent the identification of older individuals)
  • Race
  • Ethnicity
  • Marital Status
  • Codes (a random code may be used to link cases, as long as the code does not contain, or be a derivative of, the person's social security number, date of birth, phone/fax numbers, etc.)

Students, as well as therapists, often keep "working files" in their desk. This is still allowed under HIPAA guidelines, however this information must be locked in a file cabinet when not in use, and must be shredded when no longer needed.


HIPAA Frequently Asked Questions