HIPAA De-Identification: Requirements, Methods & Common Mistakes

HIPAA treats data as de-identified only when it meets one of two methods. Safe Harbor means removing 18 types of identifiers, like names, phone numbers, and exact dates. You must not know what is left could identify someone. Expert Determination means a qualified expert finds the risk of identifying someone is very small and writes down the methods and results.

HIPAA De-Identification Requirements

Many groups think data is de-identified after they remove the obvious items. But this does not meet HIPAA standards. Deleting the patient's name alone is not enough. Removing just the medical record number is also not enough.

Even removing a whole list of obvious items may still fall short. That is, if the data can tie back to the person. HIPAA de-identification has two known paths. Both need care. More than most teams expect.

This is one of the easiest areas to get wrong while still believing you are being careful.

If your team uses data for:

• Vendor troubleshooting
• Analytics
• Marketing
• Model training

Weak de-identification steps create a false comfort. They give the feel of "anonymous" data that is not truly anonymous.

Why De-Identification Matters

Data that is truly de-identified is no longer PHI under HIPAA. This matters a lot. It changes how you can use the data and lowers privacy risks. But the standard only applies if the data is truly de-identified. Groups run into trouble for a few common reasons:

• They remove too little
• They overestimate how anonymous the data is
• They use de-identified data practices inconsistently across teams and vendors

The result is risk that could have been avoided. This is especially true when data leaves its original setting. In practice, weak de-identification often goes hand in hand with weak minimum necessary controls and broad vendor access.

The Two HIPAA Methods

HIPAA allows two ways to de-identify data:

• Safe Harbor
• Expert Determination

They are different methods. Teams should stop treating them as the same thing.

Method 1: Safe Harbor

Safe Harbor is the more checklist-based path. Under this method, the group removes certain types of data. These include items that point to the person, their family, their employer, or household members. The group must also not know that the leftover data could ID the person.

Most people have heard of this method. It is easier to explain. But it is also the method most often made too simple.

What Safe Harbor Requires

Safe Harbor calls for the removal of 18 types of data, such as:

• names
• geographic areas smaller than a state, with limited ZIP code exceptions
• all date details tied to the person (except year in most cases)
• phone numbers
• email addresses
• Social Security numbers
• medical record numbers
• account numbers
• certificate and license numbers
• vehicle IDs
• device IDs and serial numbers
• URLs
• IP addresses
• biometric IDs
• full-face images
• any other unique number, trait, or code that could ID a person

That last item matters. Teams often learn the list but miss the bigger point. Safe Harbor is not about checking off fields. It is about the data that remains. Can it still point back to a person in the real world?

The 18 Safe Harbor Identifiers: Full Reference Table

OCR’s guidance lays out all 18 types in detail. Each one has edge cases that trip teams up in practice.

Three-Digit ZIP Code Rule: When Geography Can Stay

ZIP codes are not always off-limits under Safe Harbor. The rule is based on how many people live in the area:

• If all ZIP codes sharing the same first three digits cover a geographic area containing more than 20,000 people (based on current public Census Bureau data), the three-digit prefix may remain in the dataset.
• If the three-digit ZIP area covers 20,000 or fewer people, those first three digits must be changed to 000.

This matters most in rural areas. A three-digit ZIP prefix that covers a small rural county may need to be zeroed out. Urban ZIP prefixes that cover dense metro areas often pass Safe Harbor. Teams working with any map-level data below the state level should run the count check before calling the data clean.

Date Handling: Ages, Years, and the 90-Plus Rule

Dates are the most often misread Safe Harbor item. The rule allows keeping year alone: not month, not day. All other date details tied to the person must go. One exception: for anyone over 89, even the year must go if it would show their age.

The second trap is age. Safe Harbor lets you keep age, with one hard cutoff. For anyone aged 90 or older, remove the exact age or list it only as “90 or older.” The reason is simple. Very old patients in small groups are easy to re-identify from age alone. A 97-year-old patient in a rural area who had a rare treatment can be easy to pick out.

In practice, this means any dataset that keeps exact ages above 89 does not pass Safe Harbor. It does not matter what other steps were taken.

Dates and Geography Cause More Problems Than People Expect

Staff will think data is de-identified once names are gone. The problem is that the dataset still holds:

• exact admission dates
• discharge dates
• surgery dates
• city-level location data
• mixes of age, rare diagnosis, and event timing

Those details can point to a person fast. This is especially true in small towns or for unusual clinical events. A dataset that shows a:

• 92-year-old patient
• In one small town
• Who had a rare event
• On a specific date

Is easy to re-identify even without a name attached.

Method 2: Expert Determination

Expert Determination is more flexible, but also harder. Under this method, a qualified person uses stats to show that the risk of re-identification is very small. This path works when a team needs to keep more data than Safe Harbor allows. For example:

• research-support datasets
• daily analytics
• product or model development
• quality projects that need more time-based or location detail

But Expert Determination is not “our data scientist looked at it” or “IT said it seems fine.” It needs a strong expert process and clear records.

Who Qualifies as an Expert?

OCR does not certify experts for this method. The rule calls for a person with the right knowledge and skill in accepted stats and science methods for making data not linkable to a person. In practice this means:

• A stats expert with privacy or health data skills
• A bio-stats expert who knows re-identification research
• A data scientist with published work in health data masking
• An academic or consultant who can write up their method and stand behind it in an audit

An internal IT analyst or compliance officer does not qualify unless they can show that background. The expert must be truly qualified. If OCR asked, you should be able to show the expert’s credentials and a written record of the methods and results.

What the Expert’s Report Must Contain

There is no required template, but a solid Expert Determination report will cover:

• The expert’s skills and relevant background
• What data was reviewed and how it will be used
• The stats methods used to check re-identification risk
• The risk level found, and why it counts as “very small” for this data and the people who will get it. HHS guidance says no single number always meets this standard.
• Any leftover risks found and the reason for accepting them
• A clear statement that re-identification risk is very small

Without a written report, Expert Determination is just a loose opinion. The rule requires the expert to write down the methods and results of the analysis.

Statistical Methods Used in Expert Determination

Common approaches include:

• K-anonymity: Each record looks the same as at least k-1 other records on a set of quasi-identifiers. A dataset with k=5 means any one person shares all key traits with at least four others.
• L-diversity and T-closeness: These build on k-anonymity. They manage how sensitive traits spread within groups. This cuts guessing attacks even when a person’s identity is hidden.
• Differential privacy: Adds tuned noise to query results so that no single record’s presence can be found from the output.
• Risk-based modeling: Rates the real chance of re-identification using group-level data, how unique records are, and known outside data sources (e.g., voter rolls, social media).

The choice of method depends on the data type, its planned use, and the risk down the line. A report that explains why a method was chosen and how it was used is far stronger than one that just states a result.

When Expert Determination Is Better Than Safe Harbor

Expert Determination is the right choice when the data loses key research or day-to-day value under Safe Harbor’s strict removal rules. Common cases:

• Research datasets that need monthly admission trends, not just year-only dates
• Health analytics that need sub-state location detail below the Safe Harbor ZIP threshold
• AI and machine learning training sets where time or location detail makes the model more accurate
• Quality projects that need links across data points that Safe Harbor would strip

The tradeoff is cost and time. Expert Determination means hiring a qualified pro, paying for their review, and keeping their report as a compliance record. For datasets that pass Safe Harbor cleanly, that extra work is usually not needed.

Safe Harbor vs. Expert Determination

The practical tradeoff is simple:

Safe Harbor is more rigid but easier to explain.

Expert Determination is more flexible but requires stronger expertise and records.

Groups often choose Safe Harbor when they want a more standard compliance path. They choose Expert Determination when data loses too much value under Safe Harbor. The mistake is doing Expert Determination with only a rough internal review.

The Biggest De-Identification Mistakes

These are the failures that show up often:

1. Removing Names and Stopping There

This is the classic error. Teams strip the obvious direct IDs and think the dataset is now anonymous. It often is not.

2. Ignoring Combinations of Data Points

Single fields may seem harmless, but mixes create risk. Examples:

• rare condition plus exact date
• age over 89 plus location
• very specific service line plus event timing
• small staff or patient group plus internal day-to-day data

3. Reusing Internal Data for New Purposes

Data that was fine inside one workflow may not be de-identified for other uses like:

• External sharing
• Vendor use
• Marketing analysis
• Testing

Context changes the risk.

4. Sending Live PHI to Vendors for Troubleshooting

This happens all the time. Teams send screenshots. They create exports or pull logs. They share real data with vendors to skip the hassle of making sample data. That is not a de-identification plan. It is shortcut culture.

5. No Documentation of the Method Used

If someone asks how the data was de-identified, there should be a clear reply:

• which method used
• what identifiers removed
• who approved the process
• what leftover risk was weighed

If nobody can answer those questions, the process is weak.

"Actual Knowledge" Still Matters

Safe Harbor is not just about deleting items. The group must not have actual knowledge that leftover info could ID a person. In other words, if you know the rest could still point to someone, the data does not pass. You cannot strip listed data and then ignore clues your team already knows. If everyone on the team can tell who the patient is from the remaining dataset, the data is not de-identified.

De-Identification vs. Limited Data Sets

This is another common confusion point.

A limited data set is not the same as de-identified data. A limited data set may still hold some dates and limited location details. It needs a data use agreement. Teams sometimes apply limited-data-set logic while calling the result de-identified. That is the wrong label, and it matters. If the data is only partly stripped and still depends on use limits, you may not be in de-identified space at all.

What a Limited Data Set May Contain

A limited data set strips direct IDs but keeps data that Safe Harbor would remove on purpose. It may retain:

• Town or city, state, and five-digit ZIP codes (Safe Harbor removes all of these except state)
• Date details (such as admission, discharge, and service dates) that Safe Harbor limits to year only
• Ages, including ages over 89 that Safe Harbor requires removing or grouping

What it must remove: names, postal address (street), phone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan member numbers, account numbers, certificate and license numbers, vehicle IDs, device IDs, web URLs, IP addresses, biometric identifiers (such as finger and voice prints), and full-face photos.

Data Use Agreement Requirements

A limited data set can only be shared with someone who has signed a Data Use Agreement (DUA). The DUA must list the allowed uses. It must name who may use or get the data. It must also state that the recipient will:

• Use or share the limited data set only for the purposes named in the agreement
• Not try to re-identify or contact the people in the data
• Use proper safeguards to stop uses or sharing not allowed by the agreement
• Report any use or sharing that breaks the agreement
• Make sure any agents (people or companies working for them) handling the data agree to the same rules

A DUA is not the same as a Business Associate Agreement, though some groups combine them. The DUA is specific to limited data sets. It governs how the receiving party handles data that is not fully de-identified.

The bottom line: if the data must keep dates and city-level details for research or analytics, a limited data set with a proper DUA is often the right path. A limited data set is only allowed for research, public health, or health care operations. For any other use, such as a public release, you need full de-identification.

Common De-Identification Use Cases

Knowing where de-identification is used in the real world helps teams set up the right steps before data leaves a controlled setting.

Clinical Research and IRB Studies

Academic medical centers and health systems often de-identify patient records for research studies. Data that meets Safe Harbor is no longer PHI. So HIPAA does not require patient authorization (written permission) to use it. But study teams should still keep proof of the method used. Expert Determination is used when the study needs date or location detail that Safe Harbor strips.

Population Health Analytics

Health systems and payers use de-identified claims and clinical data to track disease rates, find care gaps, and model risk at the local level. Safe Harbor often works here. The exception is when the review covers small areas or rare conditions. Those cases may need Expert Determination to avoid re-identification through a mix of small groups and kept data points.

AI and Machine Learning Training Data

This is where teams most often miss the re-identification risk. Training a clinical model on de-identified patient data sounds simple. But large language models and neural nets can learn patterns that re-identify people from outputs. This risk goes beyond whether the input data was cleaned. If you use patient data for AI work, treat model outputs as a possible re-identification path, not just the training set.

Healthcare Marketing and Analytics

Using de-identified patient data for marketing analytics is allowed under HIPAA. But only if the data is truly de-identified, not just stripped of names. Ad platforms that get patient data for audience modeling are a common source of risk. This is especially true when teams confuse limited data sets with de-identified data. The minimum necessary rule applies to what data reaches marketing workflows in the first place.

Re-Identification Risk: What “Very Small” Actually Means

HIPAA’s Expert Determination standard says re-identification risk must be “very small.” The rule does not set a number. HHS guidance says no single number always meets this standard. The expert judges the risk for the specific data and for the people expected to get it.

That threshold matters because re-identification attacks have become much easier. Research has shown that:

• One widely cited study estimated that about 87% of Americans could be singled out by five-digit ZIP code, birth date, and sex alone. Many teams see those three fields as harmless.
• Mixing a rare diagnosis with age, location, and rough event date can single out a patient in a small group with no other data
• Public data sources (voter rolls, social media, property records) can be joined to “anonymous” datasets to re-identify people at scale

Under Safe Harbor, you manage re-identification risk by removing all 18 types and confirming no one knows that the leftover data points to a person. Under Expert Determination, it takes formal testing and records. With that method, the “very small” standard is not a loose goal. It is the test the expert’s written analysis must pass.

Operational Uses That Deserve Review

You should review de-identification steps if your group uses data for:

• vendor troubleshooting
• software testing
• marketing analytics
• AI or model training
• internal dashboards
• quality reporting
• case studies
• public presentations

These are the settings where teams often move fast. They assume the data is harmless because it has no patient names. That belief is what creates later exposure with vendors, contractors, and internal teams.

A Practical De-Identification Review Checklist

• Which method are we using: Safe Harbor or Expert Determination?
• Have all required data types been removed if we claim Safe Harbor?
• Does the leftover dataset still create clear re-identification risk in context?
• Are dates, location, age, and rarity creating a combined exposure?
• Are vendors receiving data that should be masked or de-identified first?
• Is the method written up enough to explain later?

If those questions produce fuzzy answers, the process needs work.

Final Takeaway

HIPAA de-identification rules are not met by surface-level edits to a dataset. The real question is not whether the most obvious IDs are gone. The question is: Is there a reasonable basis to believe the leftover info could identify a person?

That is why disciplined de-identification matters:

• choose the right method
• document the process
• think about combinations, not just fields
• do not use live PHI when masked or fake data would work

Groups that get this right reduce risk. They do so without pretending data is safer than it is.

If your current process depends on:

• Ad hoc redaction
• Screenshots
• Loose judgment calls

Review it before it turns into a privacy problem.

Learn about HIPAA consulting support

Documentation Requirements for Both Methods

HIPAA does not have a single template for de-identification records. But both methods need files that hold up in an OCR audit or legal challenge. At minimum, a group should be able to produce:

• Method chosen: Safe Harbor or Expert Determination, and the reason for the choice
• Dataset description: What data was processed, from what source, and for what intended use
• Items removed (Safe Harbor): A record showing all 18 types were reviewed and handled, including how edge cases (ZIP codes, ages over 89, dates) were treated
• Expert’s report (Expert Determination): A written report from a qualified expert that finds the re-identification risk is very small and writes down the methods and results
• Approval chain: Who approved the de-identification process and who reviewed the output before it was shared
• Ongoing review: Whether the de-identification process gets reviewed again as the data setting or use case changes

Teams that treat de-identification as a one-time tech step rather than a recorded process create a gap that shows up under audit. Good records also help if a later party misuses data. They show the method was applied correctly.

If your group needs help building a strong de-identification framework, HIPAA consulting support can speed up the process without starting from scratch.

Frequently Asked Questions

What are the 18 identifiers that must be removed for HIPAA Safe Harbor de-identification?

The 18 identifiers are: (1) names, (2) geographic data smaller than state level, (3) dates except year related to the individual, (4) phone numbers, (5) fax numbers, (6) email addresses, (7) Social Security numbers, (8) medical record numbers, (9) health plan beneficiary numbers, (10) account numbers, (11) certificate and license numbers, (12) vehicle identifiers, (13) device identifiers, (14) web URLs, (15) IP addresses, (16) biometric identifiers, (17) full-face photographs, and (18) any other unique identifying number, characteristic, or code. Ages over 89 must also be removed or grouped into a single “90 or older” category.

What is the difference between Safe Harbor and Expert Determination under HIPAA?

Safe Harbor means removing all 18 listed identifiers. You also must not know that the rest could still identify someone. Expert Determination lets you keep more detailed data such as monthly dates or sub-state geography, but a qualified statistician or privacy expert must find that re-identification risk is “very small” and write down the methods and results. Expert Determination is more flexible but costs more and needs stronger records.

Can ZIP codes be included in de-identified data?

It depends on population size. Under Safe Harbor, you may retain the first three digits of a ZIP code only if the geographic area formed by all ZIP codes sharing those three digits contains more than 20,000 people. If that area covers 20,000 or fewer people, those first three digits must be changed to 000. Rural ZIP prefixes often fail this threshold.

Does de-identified data still fall under HIPAA?

No. Once data is properly de-identified using either Safe Harbor or Expert Determination, it is no longer PHI and is not subject to HIPAA’s Privacy Rule. This is the core value of de-identification: it allows data to be used for research, analytics, or marketing without HIPAA restrictions. A limited data set, by contrast, remains PHI and still requires a Data Use Agreement.

What is a limited data set under HIPAA?

A limited data set is a middle-ground option: it strips direct identifiers like name, street address, and SSN, but may keep geographic data at the city and ZIP level plus full dates. It can be shared for research, public health, or healthcare operations under a Data Use Agreement, without full de-identification. It is still PHI; HIPAA still applies.

What are the two HIPAA de-identification methods?

They are Safe Harbor and Expert Determination. Safe Harbor removes specific identifiers from a defined list of 18 categories. Expert Determination relies on a qualified expert who uses statistical methods. The expert must find that re-identification risk is very small and write down the methods and results.

Is deleting the patient's name enough to de-identify data?

No. Removing a name alone does not de-identify someone under HIPAA. If the remaining data (such as dates, ZIP codes, age, or rare diagnoses) can still identify a person through combination or context, the data is not de-identified.

What is the difference between de-identified data and a limited data set?

A limited data set is not de-identified. It can still contain certain dates and limited geographic details such as city and ZIP code. It also requires a Data Use Agreement and remains subject to HIPAA. Fully de-identified data carries none of those restrictions.

Can I send partially redacted patient data to a vendor for troubleshooting?

Not safely by default. If the data is still identifiable, you may still be sending PHI, which requires a Business Associate Agreement and appropriate safeguards. The better approach is masking, de-identifying, or using a small synthetic (made-up) dataset that contains no real patient data.

Sources

• 45 CFR 164.514: De-Identification and Limited Data Set Standards
• HHS: Guidance on De-Identification of PHI
• 45 CFR 160.103: Definition of PHI
• NIST SP 800-188: De-Identifying Government Datasets

Related Reading

• HIPAA Minimum Necessary Rule: Why reducing data scope matters before anything leaves the workflow
• Your Vendor Got Hacked: Now What?: Why vendor data handling shortcuts become major exposure during incidents
• HIPAA Privacy Rule Requirements
• Protected Health Information Guide
• PHI vs PII vs ePHI
• Notice of Privacy Practices Guide
• Patient Rights Under HIPAA
• HIPAA Authorization Form Requirements: A separate but related records area. Teams often assume broad permission.