HIPAA De-identification: Safe Harbor, Expert Determination

The 18 categories in 164.514(b)(2): names; geographic subdivisions smaller than a state (the first three zip digits survive only if the zone exceeds 20,000 people, otherwise 000); all date elements except year (admission, discharge, birth, death), with ages 90+ aggregated; telephone and fax numbers; email addresses; SSNs; medical record numbers; health plan numbers; account numbers; certificate and license numbers; vehicle identifiers including plates; device identifiers and serials; URLs; IP addresses; biometric identifiers; full-face photos and comparable images; and any other unique identifying number, characteristic, or code. Plus the second prong everyone forgets: the covered entity must have no actual knowledge the remaining information could identify the individual, a rare diagnosis in a small town can fail that test with all 18 boxes checked.

A person with appropriate knowledge of statistical and scientific methods for rendering information not individually identifiable applies those methods and documents that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify the subject. The analysis is context-specific: it weighs who receives the data, under what controls, and what external datasets exist for linkage, meaning the same dataset can pass for one recipient and fail for another. The determination is a written, retained artifact (six years), typically with an expiration or re-evaluation trigger since external data availability changes. There is no certification body; qualification is demonstrated by training and experience, and OCR's 2012 guidance describes the accepted approaches.

A dataset stripped of 16 direct identifiers but retaining dates, city, state, and zip, disclosed only for research, public health, or health care operations, under a data use agreement binding the recipient to safeguards, no re-identification or contact attempts, and flow-down to agents. It is the workhorse for research and analytics where dates drive the science (survival analysis, epidemiology, readmission studies) and Safe Harbor's year-only rule would destroy utility. But it remains PHI: breach notification applies, minimum necessary applies, and the DUA is mandatory. Choose Safe Harbor or expert determination when you need data outside HIPAA entirely; choose the limited data set when you need dates and can keep the data inside a controlled relationship.

Once information is properly de-identified under either method it is no longer PHI, and HIPAA does not restrict its use, training models, benchmarking, licensing to third parties. Three cautions before treating that as a green light. First, the de-identification itself is a use of PHI that must be permissible, and a business associate needs BAA authority to de-identify. Second, re-identification converts everything back: a recipient who links the data to identities is creating PHI, and your contracts should prohibit attempts. Third, other regimes may still apply, state laws like Washington's My Health My Data define consumer health data more broadly, and the FTC polices deceptive claims about anonymization. 'HIPAA de-identified' is a specific technical status, not a universal privacy clearance.

Quasi-identifier convergence: the combination of zip, birth date, and sex famously identifies a large share of the US population, which is exactly why Safe Harbor attacks dates and small geography. Small cells: any subgroup of one, the only 94-year-old in the county with a given diagnosis, fails regardless of removed fields. Longitudinal linkage: visit sequences and rare event patterns can match public records or claims datasets. Derived identifiers: free-text notes carrying names, embedded accession numbers, image metadata, and pixel data (faces, tattoos) that survive structured-field scrubbing. Robust programs test outputs empirically, small-cell suppression, free-text scanning, linkage testing against public data, rather than trusting field deletion alone, because the standard is identifiability, not field count.