The HIPAA regulation describes 18 pieces of information that can be used to identify an individual, either directly or indirectly. One of these is any geographic subdivision smaller than a state.
Limited Data Sets are protected health information that lack certain specific identifiers. Limited Data Sets can include town, city, state, and full zip code, but cannot include street addresses. The federal Office for Human Research Protections has determined that Limited Data Sets do not constitute human subject material.
However, because a geocode can be tied to a specific street address, it cannot be included in a Limited Data Set. An otherwise anonymized dataset that includes geocodes will be considered human subject material, since this identifier can link to a specific address.