Table 1. Per HIPAA Privacy Rule, the following identifiers must be removed from PHI to obtain fully de-identify health information (*). As of 2010, there were 18 sets of zip codes with distinct initial three digits whose corresponding population sizes were less than or equal to 20.000 (60).