As defined in the regulations at 45 CFR 46.102 (Protection of Human Subjects 2009), private information includes:
"Information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place" "Information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a school record)"
The regulations further state that private information must be individually identifiable, that is, the identity of the subject is or may be readily ascertained by the researcher or associated with the information in order for obtaining the information to constitute research involving human subjects. The regulations provide no explanation of the words "readily ascertained," but one can assume that this means the information is available to the researcher (for example, the researcher has access to the linking code of subject ID and subject name).
The following two sections expand on the definition of identifiable private information.