HIPAA recognises two ways to de-identify health information. Safe Harbor removes a defined list of identifiers and requires that you have no actual knowledge the rest could identify anyone. Expert Determination has a qualified statistician conclude, and document, that the risk of re-identification is very small. Both are in 45 CFR 164.514(b).
How Safe Harbor works
Safe Harbor is a checklist. The identifiers of the individual, and of relatives, employers or household members, must be removed. The list covers names, geographic units smaller than a state, all date elements except year, phone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full face photographs and comparable images, and any other unique identifying number, characteristic or code.
Some details trip people up:
- ZIP codes can keep only the first three digits, and only if the combined area holds more than 20,000 people. Otherwise the three digits become 000.
- Dates directly tied to a person lose everything but the year, and ages over 89 collapse into a single 90 or older category.
- The second condition is easy to forget. You must not have actual knowledge that the remaining data could be used, alone or with other information, to identify someone.
How Expert Determination works
A person with appropriate knowledge of and experience with generally accepted statistical and scientific methods applies them and determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify a subject. That person must document the methods and results.
Notice what the text leaves open. It does not set a numeric threshold. It ties the judgment to an anticipated recipient and to what other data that recipient could plausibly have.
Choosing between them
| Question | Safe Harbor | Expert Determination |
|---|---|---|
| Effort | Mechanical, repeatable | Needs a qualified expert |
| Keeps dates and locations | No, strict limits | Possibly, if risk stays very small |
| Evidence | Show the removal rules were applied | Written method and results |
| Fits | Simple datasets, test data | Research and analytics needing detail |
If your use case needs full dates or fine geography, Safe Harbor will likely strip too much, and an expert determination can keep more utility. If you need a quick, defensible dataset for engineering tests, Safe Harbor is simpler.
Pitfalls in practice
Free text fields are the usual failure: clinician notes can hold names, places and dates the structured columns lost. Check them separately. Also check whether rare values, such as an unusual diagnosis in a small town, make a record unique even without a name. And keep the dataset from being joined back to an identified source.
If you assign a code to allow re-identification later, the regulation requires that it is not derived from information about the individual and cannot be translated back, and that you do not use or disclose it for other purposes or reveal how re-identification works.
For how this connects to lower environments, see real PHI in test and staging.
Quick check
Can I keep the year of birth under Safe Harbor?
Yes for most records, since only date elements other than year are removed. Ages over 89 and their year indicators must be grouped into 90 or older.
Is de-identified data still covered by the Privacy Rule?
Data that meets 164.514(b) is not individually identifiable health information, so those restrictions no longer apply to it. Re-identification code rules still apply to you.
Sources
Last reviewed: 19 October 2026.
