hipaa.systems
Privacy Rule · 45 CFR 164.514(a), 164.514(b)

De-identification

How HIPAA de-identification works — the Safe Harbor list of 18 identifiers and Expert Determination — and what it means for analytics, AI and research use of health data.

Checked 2026-10-06Sources 2

De-identification at a glance

Under HIPAA, de-identified health information is not protected health information and can be used without HIPAA restrictions. 45 CFR 164.514(b) allows two methods: Safe Harbor, which removes 18 specified identifiers of the individual and their relatives, employers and household members with no actual knowledge the rest could identify them; or Expert Determination, where a qualified expert documents that the risk of re-identification is very small.

Rule45 CFR 164.514(a)–(c)
Method 1Safe Harbor — remove 18 identifiers and have no actual knowledge of re-identification
Method 2Expert Determination — documented statistical analysis showing very small risk
ZIP codesOnly the first 3 digits, and only where that area has more than 20,000 people
DatesOnly the year; ages over 89 grouped as 90+
Re-identification codesAllowed if not derived from identifiers and not disclosed

Safe Harbor: remove 18 identifiers

Remove these identifiers of the individual and of relatives, employers and household members (164.514(b)(2)):

  1. Names
  2. Geographic subdivisions smaller than a state — except the first three ZIP digits where that area has more than 20,000 people (otherwise use 000)
  3. All elements of dates except year; ages over 89 grouped as 90 or older
  4. Telephone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security numbers
  8. Medical record numbers
  9. Health plan beneficiary numbers
  10. Account numbers
  11. Certificate and license numbers
  12. Vehicle identifiers, including license plates
  13. Device identifiers and serial numbers
  14. Web URLs
  15. IP addresses
  16. Biometric identifiers, including finger and voice prints
  17. Full-face photos and comparable images
  18. Any other unique identifying number, characteristic or code

…and you must have no actual knowledge that what remains could identify someone.

Expert Determination

A person with appropriate statistical and scientific expertise determines that the risk an anticipated recipient could identify someone is very small, and documents the methods and results (164.514(b)(1)). This allows more detail than Safe Harbor — useful for analytics and AI training — but requires an expert and ongoing review.

Practical points for health tech

  • Free-text fields and images often contain identifiers; Safe Harbor needs them removed too.
  • A business associate may de-identify data only if its BAA allows it.
  • You may keep a re-identification code if it isn’t derived from identifiers and isn’t disclosed (164.514(c)).

Frequently asked questions

What are the 18 HIPAA identifiers?

Names; small geographic subdivisions; dates (except year); phone and fax numbers; email addresses; SSNs; medical record, health plan, account and license numbers; vehicle and device identifiers; URLs; IP addresses; biometrics; full-face photos; and any other unique identifying number, characteristic or code.

Is de-identified data still regulated by HIPAA?

No. Properly de-identified data is not PHI. Other laws and contracts, such as your BAA, may still limit what you can do with it.

Can a business associate de-identify data it receives?

Only if its BAA permits it. The right to de-identify and use data should be addressed in the agreement.