Published:

2025-03-15

Updated:

2026-11-03

18 HIPAA Identifiers for PHI De-Identification

The 18 Safe Harbor identifiers in HHS order, a side-by-side comparison with Expert Determination, the rules that trip teams up, and a de-identification review checklist tied to third-party risk. Every figure carries a numbered source.

What does HIPAA de-identification mean, and what are the two methods for doing it?

HIPAA treats health information as de-identified when it meets one of two standards in 45 CFR 164.514(b). Under Expert Determination, a person with appropriate statistical and scientific expertise finds that the risk of identifying an individual is very small and documents the methods and results. Under Safe Harbor, the covered entity removes 18 categories of identifiers for the individual and for relatives, employers, and household members, and has no actual knowledge that what remains could identify the person. Neither method needs a data use agreement. Safe Harbor works from a fixed list that a team can apply without outside expertise, while Expert Determination fits work that needs detail the list would strip out. The choice shapes everything downstream: which fields stay in the data set, who signs off, and what documentation exists if the Office for Civil Rights asks.

What are the 18 HIPAA identifiers, and how is the list structured?

HHS labels the Safe Harbor identifiers (A) through (R), which gives exactly 18 categories. They cover personal details, location and time, record and account numbers, and digital and biological traces, and the last category is a catch-all for unique numbers, traits, or codes that identify a person and appear nowhere else on the list. Ages sit inside the dates item rather than standing alone, so a list that counts ages as their own line has to give up another category to reach 18, and the one that usually disappears is the catch-all. That matters because the catch-all is the category that covers identifiers nobody wrote down. A team that builds its checklist from the (A) through (R) structure covers the full regulation, while a checklist built from a looser list can pass a review and still miss the category that fails the standard.

What do the ZIP code, date, and age rules require under Safe Harbor?

Three rules cause the most errors. Three-digit ZIP prefixes can stay only if the combined area holds more than 20,000 people on current public Census data, and dates other than the year must go, which leaves only the year of an event. Ages over 89 are grouped into one category of 90 or older. “Safe Harbor is the more concrete of the two because the list is fixed, but the list has details that are easy to miss, such as ZIP code limits, dates tied to test results, and a catch-all category at the end.” The thresholds are exact, so a data set that keeps a month or a small-area ZIP prefix by habit fails the standard even if every other field is clean. Teams that need finer dates or geography have a second route in Expert Determination.

How does Expert Determination work, and does it need a credential or a numeric threshold?

Expert Determination is an iterative process in which an expert assesses the risk of identification, applies mitigation, and re-evaluates until the risk is very small. HHS requires no specific credential, and OCR reviews the expert’s training and experience if it asks. No numeric threshold defines very small, and no expiration date is required, though time-limited certifications are common. “No single method is required, and no universal threshold applies.” The expert documents the methods and results, and that record has to be available to OCR on request. Because the standard is a judgment rather than a checklist, the expert’s report carries the weight that the fixed list carries under Safe Harbor, so organizations choose the expert and the scope with care and keep the report with the data set. Teams planning an Expert Determination should line up that expertise before the data request arrives.

Why does de-identification belong in third-party risk work, and what do the benchmark data show?

Data sets leave the organization for vendors, researchers, and analytics partners, and any identifiers left in them travel too. “Vendors also sit behind many PHI incidents.” In the 2025 Healthcare Cybersecurity Benchmarking Study, the optional HICP section (n=32) scored Data Protection and Loss Prevention at 58%, against a 70% average across the ten practices, which leaves it among the lowest-covered. Those are self-reported coverage scores, not audit results, and the sample is smaller than the 69-organization core of the study. The benchmark does not measure de-identification itself, so it frames a question about your own data protection program rather than answering it. A third-party risk team can use it to ask which vendors receive data sets and which controls surround them. Pair the figure with your own inventory of recipients, since coverage averages say nothing about which vendors hold your data.

What should a team check first when it runs a de-identification review?

Start with where identifiers live, because the visible columns are rarely the whole problem: free-text notes, images, file names, and file metadata can all carry identifiers. Next, apply the Safe Harbor rules for ZIP codes, dates, and ages, and test the actual knowledge standard by asking whether anyone involved knows that the remaining fields could identify a person. Then check any code that replaces a real identifier. “A code built from a secure hash without a secret key counts as an identifier under Safe Harbor.” Last, record the method, the reviewer, and the date, and confirm what any receiving vendor will do with the data set. The recipient check matters because the same data set carries different exposure at different vendors. A review that follows this order catches the usual failures before data leaves the organization.

HIPAA recognizes health information as de-identified when it meets one of two standards in 45 CFR 164.514(b): Expert Determination, in which a qualified expert finds the risk of identifying an individual very small, or Safe Harbor, in which the covered entity removes 18 categories of identifiers and has no actual knowledge that what remains could identify the person [1]. Safe Harbor is the more concrete of the two because the list is fixed, but the list has details that are easy to miss, such as ZIP code limits, dates tied to test results, and a catch-all category at the end.

This post lists all 18 identifiers in the order HHS uses, compares the two methods, covers the rules that trip teams up, explains how Expert Determination works in practice, and shows why de-identification belongs in third-party risk work. Every figure is tied to a numbered source.

The two de-identification methods

Expert Determination requires a person with appropriate knowledge of and experience with generally accepted statistical and scientific methods to determine that the risk of identifying an individual is very small, and to document the methods and results [1]. Safe Harbor requires removal of the 18 listed identifiers for the individual and for the individual's relatives, employers, and household members, plus no actual knowledge that the remaining information could identify the individual [1].

Safe Harbor and Expert Determination compared
Feature	Safe Harbor	Expert Determination
What it requires	Remove the 18 identifiers for the individual and for relatives, employers, and household members	An expert finds the risk of identification very small
Who decides	The covered entity applies the list	A person with statistical and scientific expertise
Risk threshold	None; the list defines the standard	No numeric threshold defines very small
Documentation	Keep a record of the review (recommended)	Methods and results documented and available to OCR on request
Credential	None	No specific credential; OCR reviews training and experience
Data use agreement	Not required	Not required

‍

The 18 identifiers

HHS labels the Safe Harbor identifiers (A) through (R). The table keeps that order, so each row maps to the regulation [1].

The 18 Safe Harbor identifiers in HHS order
#	Identifier	What to remove or change
1	Names	All names
2	Geographic subdivisions smaller than a state	Street address, city, county, precinct, ZIP code, and equivalent geocodes; the first three ZIP digits can stay only under the 20,000-person rule
3	Dates and ages	All date elements except year that relate directly to the individual, and ages over 89, which can be grouped as 90 or older
4	Telephone numbers	All telephone numbers
5	Fax numbers	All fax numbers
6	Email addresses	All email addresses
7	Social Security numbers	All Social Security numbers
8	Medical record numbers	All medical record numbers
9	Health plan beneficiary numbers	All health plan beneficiary numbers
10	Account numbers	All account numbers
11	Certificate and license numbers	All certificate and license numbers
12	Vehicle identifiers and serial numbers	Including license plate numbers
13	Device identifiers and serial numbers	All device identifiers and serial numbers
14	Web URLs	All Web Universal Resource Locators
15	IP addresses	All Internet Protocol address numbers
16	Biometric identifiers	Including finger prints and voice prints
17	Full-face photographs	And comparable images
18	Any other unique identifying number, characteristic, or code	The catch-all; the only exception is a permitted re-identification code

‍

The regulation folds ages into the dates item and ends with the catch-all, which is the structure above. A list that counts ages separately has to drop the catch-all to reach 18, and so misses the one category that covers identifiers nobody listed.

Rules that trip teams up

Five rules cause most of the errors in Safe Harbor reviews [1].

Safe Harbor rules that trip teams up
Rule	What HHS says	Check before release
ZIP codes	The first three digits can remain only if the combined area has more than 20,000 people, based on current public Census data; otherwise they become 000	Check each three-digit prefix against current Census data. HHS lists 17 restricted prefixes from 2000 Census data and warns against relying on that list when newer data exists
Dates	Only the year can remain for dates directly related to the individual; dates tied to test results are PHI and cannot be reported, even partially	Search lab, prescription, claim, and note fields for full and partial dates
Ages	Ages over 89 must be removed, though they can be grouped into one category of 90 or older	Replace every age above 89 with the single 90 or older value
Actual knowledge	The covered entity must not have clear and direct knowledge that the remaining information could identify an individual; knowing that re-identification studies exist does not by itself count	Record who reviewed the data set and what they knew
Re-identification codes	A code can be assigned only if it is not derived from or related to information about the individual and is not used or disclosed for other purposes	Use random codes, keep the mapping separate, and never use a hash of a real identifier

‍

A code built from a secure hash without a secret key counts as an identifier under Safe Harbor. Under Expert Determination, hashed codes are permitted if the keys are not disclosed [1].

How Expert Determination works in practice

HHS describes Expert Determination as an iterative process: assess the risk, apply mitigation, and re-evaluate [1]. No single method is required, and no universal threshold applies. Assessment principles include replicability, data source availability, and distinguishability. Mitigation methods include suppression, generalization, perturbation, and k-anonymity, and OCR sets no universal value of k. An expert can produce more than one data solution, as long as the solutions cannot be combined to re-identify someone. No expiration date is required, though time-limited certifications are common.

This route takes more specialized work than applying a list, but it can keep details that Safe Harbor removes, such as full dates or fine geography, when the expert finds the risk very small. Teams that need those details for research or analytics can weigh that trade first.

Why de-identification belongs in third-party risk work

Data sets move to vendors, researchers, and analytics partners, and the identifiers in them travel too. The benchmark data show how thin the control coverage can be around data protection. In the 2025 Healthcare Cybersecurity Benchmarking Study, the optional HICP section (n=32) scored Data Protection and Loss Prevention at 58%, the second-lowest of the ten practices after Network Connected Medical Device Security at 48%, against a 70% average across practices [2]. In the same study, Strong Encryption, an Essential Goal in the HHS performance goals, scored 77% across the full sample of 69 organizations [2].

The 2024 study found that organizations whose information security leaders owned more of the cybersecurity program reported higher Data Protection and Loss Prevention coverage: 66% for the high-ownership group (n=18), 60% for the medium group (n=14), and 57% for the low group (n=24) [3]. This is an association in survey data and does not show that ownership causes coverage.

Vendors also sit behind many PHI incidents. HIPAA Journal counted 118 of the 741 breaches of 500 or more records reported to the Office for Civil Rights (OCR) in 2024 as filed by business associates [4].

A review checklist for de-identification

Choose the method. Use Safe Harbor when the list can be applied cleanly, and Expert Determination when the work needs dates, geography, or detail that Safe Harbor removes.
Map where identifiers live. Check structured fields, free-text notes, images, file names, and file metadata, not only the obvious columns.
Apply the rules in the table above. Cover the ZIP code limit, dates and test-result dates, ages over 89, and re-identification codes.
Test for actual knowledge. Ask whether anyone involved knows that the remaining fields could identify a person, and record the answer.
Document the work. Keep the method, the reviewer, and the date, since OCR can ask for the methods and results of an Expert Determination.
Check the receiving vendor. Confirm what the vendor does with the data set and whether its contract bars attempts to re-identify.

How Censinet supports third-party PHI risk

Censinet's third-party risk capability keeps a centralized vendor and product inventory, adds automated rapid inherent risk scoring, sends breach and ransomware notifications focused on the vendors in your inventory, and routes events through an incident review workflow into a Risk Register and a remediation workflow, with people making every final risk decision [5]. For de-identification work, that inventory answers a basic question: which vendors receive data sets from us, and how much risk does each carry?

Conclusion

Key points

HIPAA defines de-identification through two methods, Safe Harbor and Expert Determination. Safe Harbor depends on 18 identifiers, with specific limits on ZIP codes, dates, ages, and codes. Benchmark coverage of data protection controls is lower than for most other practices, and business associates file a share of the large breaches reported to OCR.

Next steps

Run your next de-identification request through the checklist above, and add a data-set review to your next vendor assessment.

References

U.S. Department of Health and Human Services, Office for Civil Rights. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule (45 CFR 164.514(b); page modified March 20, 2026). https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
KLAS Research and Censinet, with the American Hospital Association. Healthcare Cybersecurity Benchmarking Study 2025, Executive Summary (April 2025). https://censinet.com/2025-healthcare-cybersecurity-benchmarking-study-executive-summary
Censinet, KLAS Research, the American Hospital Association, Health-ISAC, and the Healthcare and Public Health Sector Coordinating Council. Healthcare Cybersecurity Benchmarking Study 2024 (February 2024). https://censinet.com/2024-healthcare-cybersecurity-benchmarking-study-executive-summary
HIPAA Journal. Healthcare Data Breach Statistics, updated for 2026 (statistics updated October 15, 2026, from OCR data obtained October 10, 2026). https://www.hipaajournal.com/healthcare-data-breach-statistics/
Censinet. Third-Party Risk. https://censinet.com/capabilities/third-party-risk

Which personal and contact identifiers are among the 18 HIPAA Safe Harbor identifiers?

Names: All names are on the list.
Telephone numbers: All telephone numbers must be removed.
Fax numbers: All fax numbers must be removed.
Email addresses: All email addresses must be removed.
Social Security numbers: All Social Security numbers must be removed.
Geographic subdivisions: Street address, city, county, precinct, ZIP code, and equivalent geocodes count as geographic subdivisions smaller than a state.

Which record, account, and device identifiers does Safe Harbor require removing?

Medical record numbers: All medical record numbers are covered.
Health plan beneficiary numbers: All health plan beneficiary numbers are covered.
Account numbers: All account numbers are covered.
Certificate and license numbers: All certificate and license numbers are covered.
Vehicle identifiers: Vehicle identifiers and serial numbers are covered, including license plate numbers.
Device identifiers: All device identifiers and serial numbers are covered.

Which digital, biometric, and image identifiers are among the 18, and what is the final category?

Web URLs: All Web Universal Resource Locators are on the list.
IP addresses: All Internet Protocol address numbers are on the list.‍
Biometric identifiers: Biometric identifiers, including finger prints and voice prints, are on the list.
Photographs: Full-face photographs and comparable images are on the list.
Final category: Any other unique identifying number, characteristic, or code is the eighteenth item.
Labels: HHS labels the categories (A) through (R).

What do the HHS ZIP code and date rules say about restricted prefixes, replacement values, and test-result dates?

Restricted prefixes: HHS lists 17 three-digit ZIP prefixes that were restricted under 2000 Census data.
Newer data: HHS warns covered entities not to rely on that list when more current Census data exists.
Replacement value: A restricted three-digit prefix becomes 000.
Test-result dates: Dates tied to test results are PHI.
Partial dates: Test-result dates cannot be reported even in part.
Geographic scope: Equivalent geocodes count alongside street address, city, county, and precinct.

What do the actual knowledge and re-identification code rules say under Safe Harbor?

Actual knowledge: The covered entity must not have clear and direct knowledge that the remaining information could identify an individual.
Studies: Knowing that re-identification studies exist does not by itself count as actual knowledge.
Code derivation: A re-identification code cannot be derived from or related to information about the individual.
Code use: The covered entity cannot use or disclose the code for other purposes.
Expert Determination codes: Hashed codes are permitted under Expert Determination when the keys are not disclosed.
Mapping: Keep the mapping between codes and real identifiers separate from the data set.

Which assessment principles and mitigation methods does HHS describe for Expert Determination?

Replicability: One assessment principle is whether the risk analysis can be replicated.
Data source availability: Another principle is whether outside data sources exist that could be matched to the data set.
Distinguishability: A third principle is how distinguishable individuals are within the data.
Mitigation methods: Methods include suppression, generalization, perturbation, and k-anonymity.
Value of k: OCR sets no universal value of k.‍
Expiration: No expiration date is required for a determination.

Latest Perspectives from Censinet

October 18, 2026

18 HIPAA Identifiers for PHI De-Identification

The two de-identification methods

The 18 identifiers

Rules that trip teams up

How Expert Determination works in practice

Why de-identification belongs in third-party risk work

A review checklist for de-identification

How Censinet supports third-party PHI risk

Conclusion

Key points

Next steps

References

Ready to See Censinet in Action?

Latest Perspectives from Censinet

The SAFER Guides Sat on the Shelf While the EHR Went Dark

PCI Compliant and Still Catastrophically Exposed

The Medical Device Security Gap Healthcare Has Ignored for Years

Ready to See
Censinet in Action?

18 HIPAA Identifiers for PHI De-Identification

Article Summary

The two de-identification methods

The 18 identifiers

Rules that trip teams up

How Expert Determination works in practice

Why de-identification belongs in third-party risk work

A review checklist for de-identification

How Censinet supports third-party PHI risk

Conclusion

Key points

Next steps

References

Key Points Summary

Ready to See Censinet in Action?

Latest Perspectives from Censinet

The SAFER Guides Sat on the Shelf While the EHR Went Dark

PCI Compliant and Still Catastrophically Exposed

The Medical Device Security Gap Healthcare Has Ignored for Years

Ready to See Censinet in Action?

Ready to See
Censinet in Action?