What are examples of patient identifiers?

Editorial team Published on

A Patient ID (or Medical Record Number) is a unique string of numbers or letters a clinic or hospital assigns to a person to track their health records.

Examples of Patient ID Formats

  • Numeric string: 12345
  • Facility-prefixed ID: ABC12345 or PAT-987654
  • Barcoded wristband ID: ID-0049281-A

Where to Find Your Patient ID

  • Hospital paperwork: Discharge papers or lab result sheets.
  • Billing statements: Invoice or payment summary forms.
  • Patient wristband: The barcoded band worn during a hospital stay.

Common Two-Identifier Rules

Hospitals do not rely on just one piece of information. Staff must use at least two patient identifiers before giving medicine or care.

Acceptable examples include:

  • Full legal name
  • Date of birth
  • Assigned Patient ID / MRN
  • Phone number

Note: A room number is never used as a patient ID because it changes and is not unique to a person.

What are considered patient identifiers?

Patient identifiers are specific data elements that can be used, either alone or when combined with other details, to reasonably identify an individual receiving medical care.

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, there are 18 designated identifiers that make health data recognizable as Protected Health Information (PHI). These include names, geographic data smaller than a state, specific dates related to the individual (like birth dates or ages over 89), telephone and fax numbers, email and IP addresses, and government numbers like SSNs. The full list also covers medical record and account numbers, vehicle and device serial numbers, biometric data like fingerprints or photos, and any other unique identifying codes. For the complete detailed breakdown of all 18 identifiers, you can consult the referenced web documents.

Clinical Patient Identifiers (The Two-Identifier Rule)

In clinical settings, providers adhere to The Joint Commission standards by using at least two patient identifiers—such as a name, birth date, or medical record number—to confirm identity before providing care or medications. Room or bed numbers are excluded because they frequently change.

What are the two most commonly used patient identifiers?

The two most commonly used patient identifiers in healthcare are the patient's full legal name and their date of birth (DOB).

Why These Two Identifiers Are Used

  • Standard practice: Major healthcare accreditation organizations, like The Joint Commission, require using at least two person-specific identifiers before providing treatments, procedures, or medications.
  • Error prevention: Combining a name and birth date stops dangerous mix-ups, especially when two patients have the same or similar names.
  • Best practice for verification: Medical staff typically ask patients to state their name and birth date out loud rather than asking a yes-or-no question like "Are you [Name]?"

Other Acceptable Identifiers

If a name or date of birth is unavailable, facilities may use alternative person-specific markers:

  • Medical Record Number (MRN) or unique ID number
  • Phone number or home address
  • Patient photograph in the electronic health record
  • Note: A patient's room number or bed number is never an acceptable identifier because locations can change.

What are all 18 HIPAA identifiers?

The 18 HIPAA identifiers are specific data points defined under the HIPAA Privacy Rule Safe Harbor Method that must be removed to fully de-identify health data.

The Complete List of 18 Identifiers

  • Names: Any direct names of the individual.
  • Geographic data: All geographic subdivisions smaller than a state, including street address, city, county, and precinct (with limited exceptions for the first three digits of a ZIP code).
  • Dates: All specific date elements (such as birth date, admission date, discharge date, and death date) directly related to an individual, except for the year.
  • Ages: Ages over 89, or any indicative elements of age grouped into a single category of 90 or older.
  • Telephone numbers: Direct contact phone numbers.
  • Fax numbers: Facsimile numbers.
  • Email addresses: Electronic mail contacts.
  • Social Security numbers (SSN): Government-issued social security identification.
  • Medical record numbers: Patient hospital or clinic file numbers.
  • Health plan beneficiary numbers: Insurance or health plan ID numbers.
  • Account numbers: Financial or patient account identifiers.
  • Certificate/license numbers: Professional or driver licenses.
  • Vehicle identifiers: Vehicle serial numbers and license plate numbers.
  • Device identifiers: Serial numbers or specific identifiers of medical or personal devices.
  • Web URLs: Web universal resource locators.
  • IP addresses: Internet protocol address numbers.
  • Biometric identifiers: Fingerprints, voice prints, and retinal or iris patterns.
  • Full-face photographs: Any comparable or full-face photographic images.
  • Any other unique identifying code or characteristic: Any unique internal code or trait assigned to the person outside of standard medical data.

What are some examples of acceptable patient identifiers?

Acceptable patient identifiers include person-specific details like a full legal name, date of birth, or medical record number (MRN).

Acceptable Patient Identifiers

According to healthcare safety standards (such as those from The Joint Commission), staff must use at least two patient identifiers before providing care, medications, or procedures. Valid examples include:

  • Full legal name (first and last name as listed on official records)
  • Date of birth (month, day, and year)
  • Medical record number (MRN) or unique hospital ID number
  • Assigned encounter or visit number
  • Government-issued photo ID or verified patient photograph
  • Home address or telephone number (if facility policy allows)
  • Biometrics (such as fingerprints or facial scans) or barcoded wristbands

Unacceptable Identifiers

Never use location-based or non-unique details to verify a patient. Unacceptable examples include:

  • Room number or bed number (patients move frequently)
  • Clinical diagnosis or condition
  • Nicknames or initials
  • Visual recognition by staff alone

Identifying Patients Correctly

9 related questions found

What are some examples of patient identifiers?

Patient identifiers are specific pieces of information used to reliably match a person to their correct health records, treatments, and care events.

Acceptable Clinical Identifiers

Healthcare providers use these person-specific details to verify identity (usually requiring at least two distinct identifiers before giving medications, drawing blood, or performing procedures):

  • Full legal name
  • Date of birth (DOB)
  • Medical record number (MRN)
  • Assigned identification or account numbers
  • Government-issued photo ID
  • Biometrics (such as fingerprints or facial scans)
  • Verified patient photograph
  • Phone number or address

Unacceptable Identifiers

Non-specific location data can never be used as a primary or sole patient identifier because locations change and multiple patients can occupy or share them:

  • Room number
  • Bed number
  • Physical department or unit name

What is not considered a patient identifier?

Clinical data, general demographic categories, and broad geographic or date components are not considered patient identifiers under the HIPAA Privacy Rule.

Clinical and Medical Data

  • Diagnosis codes: Conditions like ICD-10 codes or specific disease names (e.g., Type 2 diabetes).
  • Lab results and vitals: Blood pressure readings, lab values, or test measurements.
  • Treatment details: General descriptions of procedures or medications prescribed, without personal links.

General Demographics and Attributes

  • Basic categories: Gender, race, ethnicity, or general age (as long as the patient is under 90 years old and not tied to a specific birth date).
  • Standalone clinical context: Mentioning that a "42-year-old male was treated for a broken bone" does not identify a specific person.

Broad Geographic and Date Elements

  • State names: General state-level location data (provided it is not part of a smaller subdivision like a street address or specific ZIP code).
  • Years alone: Calendar years related to dates, provided specific days, months, or exact admission/discharge timestamps are removed.
  • Room numbers: Under clinical safety standards like Joint Commission guidelines, a room number is an invalid patient identifier for bedside care confirmation.

What are two acceptable patient identifiers?

Two acceptable patient identifiers commonly used in healthcare according to The Joint Commission are a patient's full legal name and their date of birth.

Acceptable Patient Identifiers

  • Full legal name: The first and last name as documented in the patient's medical record.
  • Date of birth (DOB): Spoken directly by the patient or a caregiver.
  • Medical record number (MRN): A unique number assigned by the facility.
  • Assigned ID number: A distinct visit or encounter number.
  • Phone number or address: Contact details on file verified with the patient.

Unacceptable Identifiers

  • Room number or bed location: Patients move or switch rooms, making this unreliable.
  • Diagnosis or physical condition: Multiple people can share the same medical issue.

Standard verification protocols require an active process where the patient states their identifiers unprompted, which are then cross-referenced against the medical order and the patient's identification band before any procedure or medication administration occurs.

What are the three core patient identifiers?

The three most common core patient identifiers used to verify identity in healthcare are a patient's full legal name, date of birth (DOB), and a unique identification number (such as a medical record number or MRN).

While major standards like The Joint Commission officially require at least two patient identifiers before providing treatments, medications, or drawing blood, many clinical workflows and high-risk procedures mandate or recommend a third core identifier for an extra layer of safety.

Core Patient Identifiers

  • Full Legal Name: The patient’s first and last name. (Names alone are insufficient because multiple patients can share the same name).
  • Date of Birth (DOB): The patient's birth date, which helps separate individuals with similar or identical names.
  • Medical Record Number (MRN) or Unique ID: An assigned identification number specific to the patient or the current hospital visit/encounter.

Unacceptable Identifiers

  • Room or bed numbers: Never use a patient's physical location because patients can move or beds can be reassigned.
  • Patient diagnosis or condition: Clinical details do not uniquely identify an individual.

What are acceptable client identifiers?

Healthcare providers must use at least two acceptable client identifiers before administering medications, blood products, or performing procedures.

Acceptable Identifiers

  • Full name (first and last name as listed on the medical record)
  • Date of birth (DOB)
  • Assigned identification number (such as a medical record number or hospital ID number)
  • Client photograph or photo ID card
  • Telephone number or address on file
  • Barcode or RFID technology on a wristband

Unacceptable Identifiers

  • Room number or physical location (patients move and rooms are shared)
  • Bed number
  • Medical diagnosis or condition
  • Provider's name
  • Unconfirmed verbal "yes" without the patient actively stating their information

To learn more about standards, you can review The Joint Commission Standards FAQs.