HIPAA De-Identification: Safe Harbor vs. Expert Determination

Under HIPAA’s Privacy Rule, Safe Harbor and Expert Determination are the two paths to de-identify protected health information, and the choice comes down to a tradeoff between simplicity and data utility. Safe Harbor is a fixed checklist: strip 18 categories of identifiers and the data is presumed de-identified. Expert Determination is a statistical judgment: a qualified professional certifies that the risk of re-identifying anyone in the dataset is “very small,” which lets you keep fields Safe Harbor would force you to remove. Once data qualifies under either method, it is no longer protected health information and falls outside the Privacy Rule entirely.¹

How Safe Harbor Works

Safe Harbor is mechanical. You remove every item on a list of 18 identifier categories, confirm you have no actual knowledge that the remaining data could still identify someone, and you are done. No statistician. No risk modeling. The rigidity is the price: you strip everything on the list even when doing so damages the dataset for your intended purpose.

The 18 categories that must be removed:¹

Names
Geographic data smaller than a state — street address, city, county, precinct, and ZIP code (with a limited ZIP exception below)
Dates related to an individual — birth date, admission date, discharge date, date of death — all elements except year
Phone numbers
Fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate and license numbers
Vehicle identifiers and serial numbers, including license plates
Device identifiers and serial numbers
Web URLs
IP addresses
Biometric identifiers, including fingerprints and voiceprints
Full-face photographs and comparable images
Any other unique identifying number, characteristic, or code, unless it qualifies as a re-identification code under the rules below

The actual-knowledge condition is easy to overlook. If you know that a combination of remaining data points still points to a specific patient, the dataset is not de-identified regardless of what you removed.¹

The ZIP Code Exception

You can keep the first three digits of a ZIP code if the geographic area formed by all ZIP codes sharing those three digits has a population greater than 20,000, based on Census Bureau data. If the population is 20,000 or fewer, those three digits must be replaced with “000.”²

The Age 89 Rule

You may keep the year portion of a date, so “2024” is fine but “March 15, 2024” is not. For individuals over age 89, even the year must go if it would reveal their age. All ages above 89 and all date elements indicating such an age can be collapsed into a single “90 or older” category.³ The older someone is, the smaller the group who share that age, and the easier re-identification becomes.

How Expert Determination Works

Expert Determination replaces the checklist with a person. The regulation requires someone with appropriate knowledge of and experience with generally accepted statistical and scientific principles for rendering information not individually identifiable.¹ That expert evaluates whether the data, alone or combined with other reasonably available information, could allow an anticipated recipient to identify a subject. The standard the expert must certify is that the risk is “very small.”

The assessment weighs what external datasets exist, how likely a linkage attack would be, and how unique the remaining data combinations are. The expert documents both methods and results, and that documentation must be available to the Office for Civil Rights on request.¹

OCR does not prescribe a specific process or methodology. The regulation cares about the conclusion and the documentation, not the particular statistical technique. An expert might apply k-anonymity, differential privacy, or another approach depending on the dataset and its intended use.²

Reassessing Over Time

The Privacy Rule does not attach an explicit expiration date to a determination. HHS guidance recognizes that technology, social conditions, and available data sources change, and many practitioners issue time-limited certifications. When the window closes, new releases of the same dataset to the same recipient should be re-evaluated to confirm the “very small” standard still holds.² Data already released during a valid certification period does not retroactively lose its de-identified status when the window expires.

Choosing Between the Two Methods

For straightforward datasets where the stripped identifiers were not analytically important, Safe Harbor is faster, cheaper, and easier to defend. You do not need to hire anyone, and the audit trail is a matter of confirming the checklist.

Expert Determination pays for itself when Safe Harbor’s rigidity destroys utility. Clinical trial data that turns on specific dates, ages above 89, or narrow geographic regions can end up unusable after a full Safe Harbor strip. Expert Determination lets you keep more granular data as long as overall re-identification risk stays very small. The tradeoff is a qualified professional, a defensible statistical analysis, and periodic reassessment.

A rough test: if you can list the specific fields you need to keep and none of them are on the 18-category list, Safe Harbor is likely the right answer. If your list includes exact dates, small-area geography, ages over 89, or unusual demographic combinations, Expert Determination is worth pricing out.

The Limited Data Set Alternative

Before committing to either method, know that a third option exists for some uses. A limited data set removes direct identifiers like names, Social Security numbers, and contact information, but it can retain dates (including full birth, admission, and discharge dates) and geographic information at the city, county, and ZIP code level.²

The catch: a limited data set is still protected health information. You can only share it under a Data Use Agreement that specifies who may access the data and for what purposes, requires the recipient to apply safeguards, and prohibits re-identification or contact with individuals.⁴ Limited data sets are permitted only for research, public health activities, and healthcare operations. If exact dates or city-level geography are what you need, a limited data set with a Data Use Agreement may be simpler than paying an expert to justify keeping those fields in a fully de-identified release.

Re-Identification Codes

Both methods allow you to embed a code that lets you reconnect de-identified data with the original records later, useful for follow-up research. The Privacy Rule imposes two conditions. The code cannot be derived from or related to any information about the individual, and it cannot be translatable to the individual’s identity on its own. And the covered entity cannot use or disclose the code for any purpose other than re-identification, or disclose the re-identification mechanism to outside parties.³

Practically, that rules out using a medical record number or Social Security number as the code. Organizations generate a random alphanumeric string and hold a separate, secured crosswalk that maps the code to the original record. The crosswalk itself is protected health information and must be safeguarded accordingly.

Documentation and Retention

Documentation is the backbone of compliance under either method. For Expert Determination, the expert’s report must detail the statistical methods used and the results justifying the very-small-risk conclusion.¹ For Safe Harbor, keep records showing which identifier categories were removed, the logic applied to edge cases like ZIP codes and ages over 89, and verification that no residual identifiers remain.

HIPAA’s general documentation retention rule requires covered entities to keep compliance-related records for six years from the date of creation or the date they were last in effect, whichever is later.⁵ That applies to de-identification records too. If OCR asks about a dataset you released three years ago, you need the expert’s report or the Safe Harbor audit trail in hand.

Penalties for Getting It Wrong

Civil monetary penalties are tiered by culpability and adjusted annually for inflation. As of 2026:⁶

Did not know and could not have known through reasonable diligence: $145 to $73,011 per violation, up to $2,190,294 per calendar year
Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, up to $2,190,294 per calendar year
Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, up to $2,190,294 per calendar year
Willful neglect, not corrected within 30 days: $73,011 to $2,190,294 per violation, up to $2,190,294 per calendar year

Criminal exposure runs on a separate track. Knowingly obtaining or disclosing protected health information in violation of HIPAA carries up to one year in prison and a $50,000 fine at baseline, rising to five years and $100,000 for offenses committed under false pretenses, and to ten years and $250,000 when the violation involves intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain, or malicious harm.⁷

The gap between a good-faith mistake and willful neglect is a factor of roughly 500 on the minimum civil penalty. Whichever de-identification method you choose, documented procedures, regular audits, and prompt correction of errors are what separate the two tiers when OCR reviews your file.

1
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
2
U.S. Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule
3
eCFR. 45 CFR 164.514 – Other Requirements Relating to Uses and Disclosures of Protected Health Information
4
U.S. Department of Health and Human Services. Disclosures for Emergency Preparedness – A Decision Tool: Data Use Agreement
5
eCFR. 45 CFR 164.530 – Administrative Requirements
6
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
7
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information