Tag every database column with a sensitivity label by walking the schema against the 18 identifier types in the HIPAA Safe Harbor list, then use the tags to drive logging, export, test data and access rules. The list is written for de-identification, but it makes a practical checklist for engineers.
Why tagging beats memory
Most schemas grow for years. Nobody remembers that the legacy notes table has a phone number in a free text field. Without labels, every rule about logging or exports depends on someone remembering. With labels, tools and reviewers can check automatically.
Be clear about scope. The identifier list in 45 CFR 164.514(b)(2)(i) defines what must be removed from a dataset to meet the Safe Harbor method. It is not a full definition of protected health information, and meeting it requires also that you have no actual knowledge that the remainder could identify a person. Your counsel decides what applies to you. For engineering, the list is a strong prompt for what to inspect.
The identifier types to look for
According to the rule text, the Safe Harbor list includes names, geographic subdivisions smaller than a state, date elements other than year, ages over 89, telephone and fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, vehicle and device identifiers and serial numbers, web URLs, IP addresses, biometric identifiers, full face photographs and any other unique identifying number, characteristic or code.
Notice the less obvious ones: dates, device serial numbers, IP addresses and URLs. Those show up in event tables and audit tables, not only in patient profiles.
A simple label set
| Label | Meaning | Example columns |
|---|---|---|
| direct | Identifies a person alone | name, email, phone, record number |
| quasi | Identifies in combination | birth date, postal code, device serial |
| clinical | Health content | diagnosis, note, lab value |
| secret | Credentials | password hash, API token |
| internal | None of the above | row ID, created flag |
Keep five labels or fewer. Teams abandon complicated schemes.
Steps
- Export the schema, including every table, view and JSON column.
- Walk each column against the identifier list and the label set.
- Store the labels next to the schema, as comments or in a metadata file in version control.
- Add a check in CI that fails when a new column has no label.
- Use the labels to generate the never-log list, the export allowlist and the test data rules.
- Review free text and JSON columns by sampling real rows with a privacy owner.
Step 4 is what keeps it alive. A new column without a label blocks the pull request, and the author picks one in a minute.
Where tags pay off
- Logging: the logger refuses fields labeled direct, quasi, clinical or secret.
- Exports: reports include only allowlisted columns.
- Test data: the generator replaces tagged columns with synthetic values.
- Access: reviewers see which services read which labels.
Where Safeguard fits
Safeguard offers policies, gates and guardrails for pull requests and compliance and evidence automation, which suit a rule such as no unlabeled schema change. The labels and decisions are yours. A free scan is available at gold.safeguard.sh/scan.
Quick check
Are the 18 identifiers the definition of PHI?
No. They are the Safe Harbor removal list for de-identification. Use them as a checklist, and ask counsel about scope.
Do audit tables need labels too?
Yes. Audit and event tables often hold IP addresses, dates and record numbers.
Sources
Last reviewed: 19 October 2026.
