Confidentiality protections cover not just a patient's health-related information, such as his or her diagnosis, but also other identifying information such as social security number and telephone…

HIPAA defines 18 specific identifiers that, when combined with health information, constitute PHI requiring protection - these include names, geographic data, dates, phone numbers, fax numbers, email addresses, Social Security numbers, and more. The regulation recognizes that non-clinical identifiers can be used to re-identify a patient, making the combination of any such identifier with health information just as sensitive as the clinical data itself. Protecting all 18 identifiers is required for information to be considered properly de-identified under the Safe Harbor method.

This is false because HIPAA explicitly lists telephone numbers and Social Security numbers among the 18 identifiers that must be protected as part of PHI.