United States, health data

HIPAA safe harbor identifiers: the 45 CFR 164.514 text

Updated

HIPAA gives two routes to de-identified health information, and the safe harbor route is a list of identifiers to remove.

Talk to a specialist

The removal route

The regulation says that "the following identifiers of the individual or of relatives, employers, or household members of the individual, are removed", and its list begins with names (45 CFR 164.514).

The expert route

The other route is a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles determining that the information is not individually identifiable.

Re-identification codes

A covered entity may assign a code for re-identification, but the text says it does not use or disclose the code for any other purpose, and does not disclose the mechanism for re-identification.

De-identifying data to license it?

Has a buyer already made an offer for the data?

Tick the box above to send your enquiry.

Find the standard before you redact

Two choices: the data and your method. The answer quotes the standard that governs it.

Questions, answered directly

Can a HIPAA de-identified dataset keep a re-identification code?

The regulation allows a code, provided it is not used or disclosed for any other purpose and the mechanism for re-identification is not disclosed.

Sources

This site's own dataset, every figure quoted from its source and dated:

  1. 45 CFR 164.514 - HIPAA de-identification standard (safe harbor, 18 identifiers)
  2. HHS, guidance on methods for de-identification of PHI
  3. California Civil Code 1798.140 (CCPA definitions incl. deidentified)
  4. 34 CFR 99.31 - FERPA disclosure of de-identified education records
  5. NIST SP 800-188, De-Identifying Government Datasets
  6. NIST IR 8053, De-Identification of Personal Information
  7. Regulation (EU) 2016/679 (GDPR), incl. Art. 4(5) pseudonymisation and Recital 26
  8. EDPB Guidelines 01/2025 on pseudonymisation
Talk to a specialist