Protected Information: 500.1(k)

Nonpublic Information is protected under the Regulation and defined at 500.1(k).

(1) Business related information of a Covered Entity the tampering with which, or unauthorized disclosure, access or use of which, would cause a material adverse impact to the business, operations or security of the Covered Entity; 

(2) Any information concerning an individual which because of name, number, personal mark, or other identifier can be used to identify such individual, in combination with any one or more of the following data elements: 

     (i) social security number, 

     (ii) drivers’ license number or non-driver identification card number, 

     (iii) account number, credit or debit card number, 

     (iv) any security code, access code or password that would permit access to an individual’s financial account, or 

     (v) biometric records; 

(3) Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or an individual and that relates to 

     (i) the past, present or future physical, mental or behavioral health or condition of any individual or a member of the individual's family, 

     (ii) the provision of health care to any individual, or 

     (iii) payment for the provision of health care to any individual.