Definition
De-Identification
De-identification is the process of removing or transforming identifiers in health data so that it no longer identifies individuals. Data that meets the HIPAA de-identification standard is no longer protected health information.
2 min readReviewed September 14, 2026
Also known as: HIPAA de-identification, Safe Harbor method, Expert Determination method, De-identified data
Key facts
- Standard
- 45 CFR 164.514(a) and (b)
- Methods
- Safe Harbor or Expert Determination
- Safe Harbor list
- 18 categories of identifiers must be removed
- Guidance
- HHS Office for Civil Rights de-identification guidance, issued in 2012
- Legal effect
- De-identified data is outside the HIPAA Privacy Rule
What is de-identification?
HIPAA lets covered entities and business associates use and share health data without patient authorization once it is de-identified. The core test is whether there is a reasonable basis to believe the remaining data could identify a person.
De-identification differs from a limited data set. A limited data set removes direct identifiers but may keep dates and some geographic detail such as city, state and ZIP code, so it remains protected health information (PHI) and requires a data use agreement.
How HIPAA de-identification works
HIPAA recognizes two methods:
- Safe Harbor: remove 18 types of identifiers, including names, geographic subdivisions smaller than a state, all date elements except year that relate to the individual, contact details, record and account numbers and full-face photos, and have no actual knowledge that the rest could identify someone.
- Safe Harbor details: the first three digits of a ZIP code may be kept only if that area contains more than 20,000 people, and ages over 89 must be grouped into a single category of 90 or older.
- Expert Determination: a qualified expert applies accepted statistical and scientific methods, concludes that the risk of identification by the anticipated recipient is very small, and documents the analysis.
- Re-identification codes: a covered entity may assign a code for re-linking if the code is not derived from the individual's information and the method is not disclosed.
Why de-identification matters
Most commercial health data flows depend on it:
- Real-world data: claims and EHR data licensed for research and commercial analytics is typically de-identified, often through expert determination.
- Data linkage: tokenization links records about the same person across data sets without names, but linking can raise re-identification risk and is commonly evaluated under expert determination.
- AI training: developers need a clear de-identification basis before training models on clinical notes, which can hide identifiers in free text.
- Contracts and state law: data agreements often ban re-identification, and some state laws regulate de-identified data beyond HIPAA.