HIPAA De-Identification: Safe Harbor, Expert Determination, Penalties

HIPAA recognizes two de-identification methods, and a covered entity or authorized business associate can use either one. The Safe Harbor method requires stripping 18 specified categories of identifiers from the dataset. The Expert Determination method has a qualified statistician or similar professional analyze the data and certify that the risk of re-identifying any individual is very small. Data that clears either bar stops being protected health information, and the Privacy Rule’s restrictions on use and disclosure fall away. Data that falls short remains fully protected, and mishandling it can trigger civil penalties reaching $2,190,294 per violation category per year, along with possible criminal charges.

The Safe Harbor Method

Safe Harbor is a checklist. Remove every item on the list from 45 CFR 164.514(b)(2), and the data qualifies as de-identified.¹ The 18 categories are:

Names
Geographic data smaller than a state, including street addresses, cities, counties, zip codes, and equivalent geocodes
Dates directly related to the individual, including birth, admission, discharge, and death dates (year alone may remain, with an age-89 exception below)
Phone numbers
Fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate and license numbers
Vehicle identifiers and serial numbers, including license plates
Device identifiers and serial numbers
Web URLs
IP addresses
Biometric identifiers, including fingerprints and voiceprints
Full-face photographs and comparable images
Any other unique identifying number, characteristic, or code

That last catch-all does more work than it looks like it does. Anything in the record that could single out a particular person, even if it doesn’t match a named category, has to go.

Zip Codes and the 20,000 Rule

Full zip codes come out. The first three digits can stay if the geographic area covered by those digits has a population above 20,000, based on current Census Bureau data. If the population is 20,000 or fewer, those three digits must be replaced with “000.”² In sparsely populated regions, even a partial zip narrows the pool of possible individuals too far.

Ages Above 89

Any age above 89 must be removed or aggregated into a single “90 or older” bucket. The same rule applies to any date element, including a year, that would reveal an age above 89.² At very advanced ages the number of possible matches shrinks quickly, and precise ages become de facto identifiers.

The Actual Knowledge Backstop

Even after all 18 categories are gone, Safe Harbor fails if the covered entity has actual knowledge that the residual data could still identify someone.¹ This is the trap for records involving rare diagnoses or small patient populations. If a hospital treated one person with a particular condition last year, the clinical narrative alone can point to that person even with every listed identifier scrubbed. You have to ask whether what remains functions as a fingerprint.

The Expert Determination Method

When Safe Harbor is too blunt, Expert Determination lets a qualified professional analyze the dataset and certify that the risk of re-identification is very small. Under 45 CFR 164.514(b)(1), the expert applies statistical and scientific methods, considers who will receive the data and what other information those recipients could reasonably access, and documents both the analysis and the conclusion.¹

The advantage is flexibility. An expert can leave certain elements in place if overall risk stays low. A researcher studying regional disease patterns might need city-level geography that Safe Harbor strips out. The expert can approve keeping it after modeling the probability that any individual could be singled out, often applying suppression, generalization, or the addition of statistical noise.

Who Counts as a Qualified Expert

The Privacy Rule does not require a specific degree or certification. The Office for Civil Rights weighs three things: relevant professional experience, academic or other training, and hands-on experience with de-identification of health information.² In practice, these experts come from statistics, mathematics, or computer science. Because there’s no formal credentialing program, the covered entity bears the risk of picking someone OCR later deems unqualified. Vetting matters.

How Long a Determination Holds

The Privacy Rule attaches no expiration date to a certification. HHS guidance does acknowledge that computing power, publicly available datasets, and social conditions all shift over time, and each of those changes can push re-identification risk upward. Some experts issue time-limited certifications with a built-in reassessment.² Data that has already been released doesn’t retroactively lose de-identified status when a certification lapses, but future releases to the same recipient need a fresh analysis.

Choosing Between the Two Methods

Safe Harbor is faster, cheaper, and doesn’t require hiring anyone, which is why most organizations reach for it first. It works well when the research or analytics use case doesn’t need geographic detail below the state level or precise dates. When the project does need those elements, or when the dataset includes unusual variables that could quietly re-identify people, Expert Determination is the safer route.

Genomic data is one clear example. Genetic sequences aren’t named in the 18 Safe Harbor categories, and HHS hasn’t issued guidance clarifying whether they qualify as biometric identifiers or fall under the catch-all category. Removing the standard 18 categories from a dataset containing genetic sequences may technically satisfy Safe Harbor while still leaving data that researchers have shown can be re-identified by matching against reference samples or public genealogy databases. For genomic data, Expert Determination lets a professional directly assess the risk given the intended recipients and available matching tools.

Limited Data Sets Are Not De-identified Data

A limited data set is a separate category that people sometimes confuse with de-identification. It strips out 16 direct identifiers, such as names, contact information, Social Security numbers, and device identifiers, but keeps dates and city, state, and zip code.³ That makes it useful for time-series or geographic research. But a limited data set is still protected health information. It can only be shared for research, public health, or health care operations, and the covered entity must sign a data use agreement with each recipient requiring safeguards, prohibiting re-identification, and binding downstream agents to the same terms.⁴ A breach of a limited data set triggers the full HIPAA notification process.

Building a Valid Re-identification Code

Organizations often need a way to link de-identified records back to the original patient later, such as for follow-up in a longitudinal study. The regulation allows a re-identification code, but with tight rules. Under 45 CFR 164.514(c), the code cannot be derived from any information about the individual. A hashed Social Security number or a combination of birth date and initials both fail, because anyone with the algorithm can reverse the process.¹ The code cannot be used for any purpose other than linking back to the original record, and the re-identification mechanism cannot be disclosed to anyone outside the covered entity. If a third party gets the key, the data may lose its de-identified status entirely.

The rule is technology-neutral, but the two pathways treat cryptographic codes differently. Under Safe Harbor, a hash generated without a secret key or salt counts as an identifying element and must be removed, because a recipient could reverse an unsalted hash. Under Expert Determination, cryptographic hashes are permissible as long as the keys or salts are never disclosed to recipients.² If you’re relying on Safe Harbor, use a truly random code with no mathematical relationship to the patient’s identity.

What Changes Once Data Is De-identified

Data that meets either standard is no longer protected health information. The Privacy Rule’s restrictions on use, disclosure, patient authorization, breach notification, and accounting of disclosures stop applying.² The organization can share or sell the data without patient consent, use it for commercial analytics, or distribute it to researchers without a data use agreement.

That freedom ends if the data is re-identified. Once records are successfully linked back to individuals, the information regains status as protected health information, and every Privacy Rule obligation returns. A covered entity that discovers re-identification faces the same breach notification duties as any other unauthorized disclosure, including individual notice within 60 calendar days of discovery and notice to the Secretary of HHS.⁵

Penalties for Getting It Wrong

Civil penalties are adjusted annually for inflation and run in four tiers by fault: no knowledge, reasonable cause, willful neglect corrected within 30 days, and willful neglect not corrected. The bottom tier starts at $145 per violation. The top tier ranges from $73,011 to $2,190,294 per violation, with a calendar-year cap of $2,190,294 for identical violations in each tier.⁶ Because each affected record can count as a separate violation, a botched de-identification effort across thousands of records can stack quickly.

Criminal penalties apply on top of the civil scheme. Knowingly obtaining or disclosing individually identifiable health information in violation of the rules carries fines up to $50,000 and one year in prison. Violations involving false pretenses raise the ceiling to $100,000 and five years. Violations committed with intent to sell the information or use it for personal gain or malicious harm carry fines up to $250,000 and up to 10 years.⁷ Criminal cases are rarer than civil enforcement, but the Department of Justice does pursue them where the conduct is egregious.

1
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
2
U.S. Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information
3
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
4
U.S. Department of Health and Human Services. Disclosures for Emergency Preparedness – Data Use Agreement
5
eCFR. Notification in the Case of Breach of Unsecured Protected Health Information
6
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
7
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information