Free tools Windows power users keep installed
One-click scans. No signup required.
HIPAA recognizes two methods for de-identifying protected health information (PHI): Safe Harbor, which removes the Privacy Rule’s specified identifiers and also requires no actual knowledge that the remaining information could identify someone; and Expert Determination, which uses a qualified person’s documented assessment to find identification risk “very small” for an anticipated recipient. Neither method guarantees zero risk, and HIPAA does not require one method in every case.
How the two HIPAA methods differ
| Decision point | Safe Harbor | Expert Determination |
|---|---|---|
| Legal test | Remove the listed identifiers concerning the individual and specified relatives, household members, or employers, and have no actual knowledge that the remaining information could identify the individual. | A suitably knowledgeable and experienced person applies generally accepted statistical and scientific principles, finds identification risk very small for an anticipated recipient using reasonably available information, and documents the methods and results. |
| How prescriptive it is | Uses categorical rules, including specific handling of dates, ages over 89, and three-digit ZIP codes. | Allows methods to be tailored to the dataset, recipient, and disclosure environment; the regulation does not prescribe a single technique. |
| Data utility | Some fields may need to be removed or generalized to meet the categorical rules. | Mitigations can be iterated to balance utility and risk, but usefulness does not establish that the legal test is met. |
| Expertise and records | Requires correctly applying the identifier rules and addressing actual knowledge. | Requires appropriate expertise and written documentation of the analysis methods and results, which must be available to HHS on request. |
| Risk over time | Some residual risk can remain after proper application. | Risk depends on context and may change as technology and outside information change; HIPAA sets no universal expiration interval. |
Both methods are established in the HIPAA Privacy Rule at 45 CFR § 164.514(b). The regulation and HHS guidance describe the two routes; neither is a promise that re-identification is impossible. Read the regulation text and HHS’s de-identification guidance.
As an Amazon Associate I earn from qualifying purchases.
What Safe Harbor requires
Safe Harbor has two parts: remove the rule’s enumerated identifiers wherever they appear in the information, and ensure the covered entity does not actually know that the remaining information could identify the individual, alone or combined with other information. The regulation identifies 18 categories. They include names; most geographic subdivisions smaller than a state; most person-related date elements other than year; ages over 89; telephone and fax numbers; email addresses; Social Security numbers; medical-record, health-plan, and account numbers; certificate or license numbers; vehicle and device identifiers; URLs and IP addresses; biometric identifiers; full-face images; and other unique identifying numbers, characteristics, or codes, subject to the rule’s provision for re-identification codes. See the HHS Summary of the HIPAA Privacy Rule and 45 CFR § 164.514 for the full list and conditions.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDates and ages
For dates directly related to an individual, remove all elements other than the year. If the person is older than 89, group the age and date elements indicative of that age into “90 or older.” These rules apply to date details wherever they occur, not just in a dedicated date field.
#1 Best Overall
Three-digit ZIP codes
A three-digit ZIP-code prefix may be retained only if the geographic area formed by combining all ZIP codes with that prefix contains more than 20,000 people according to current publicly available Census data. If it does not, replace the prefix with “000.” This population figure is a regulatory condition for retaining a prefix, not a measure of re-identification probability.
Free text and actual knowledge
The identifier rules apply to narrative text as well as standardized fields. HHS says recognizable identifiers in free text must also be addressed. Removing the listed fields is not enough if the organization actually knows that residual details could identify someone. HHS’s example is a distinctive occupation that becomes identifying when combined with other facts. The actual-knowledge condition is separate from the checklist.
What Expert Determination requires
An expert must determine that “the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information.” The expert evaluates risk in the context of the dataset, recipient, and information reasonably available to that recipient; the regulation requires documentation of the methods and results supporting the determination.
Recommended Free Tools
HHS does not specify a required degree or certification program. It says OCR would consider relevant professional experience and academic or other training, including actual experience with de-identification methods. The person must have appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable.
Rank #3
No universal numeric threshold or prescribed technique
HIPAA does not set a universal numeric risk threshold for “very small,” nor does it require one statistical technique. HHS states: “There is no explicit numerical level of identification risk that is deemed to universally meet the ‘very small’ level indicated by the method.” A numeric estimate, when used, must therefore be interpreted in context rather than treated as a regulatory safe-harbor number.
A practical assessment process
HHS describes an iterative approach: evaluate risks associated with the data and recipient, identify statistical or scientific mitigations, work with data managers to apply them, and reassess the resulting information. If the reassessment does not support a very-small-risk conclusion, further mitigation may be needed. The process can weigh data utility against disclosure risk, but retaining more useful detail does not substitute for satisfying the legal standard.
Documentation and reassessment
The expert must document the analysis methods and results that justify the determination; that record must be available to HHS on request. The Privacy Rule does not explicitly require an expiration date. Because technology, social conditions, and available information can change, organizations may consider reassessment or time-limited certifications in light of their expected disclosure environment. HIPAA does not establish a standard renewal period.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRe-identification codes and residual risk
Safe Harbor permits a covered entity to assign a code that allows later re-identification only if the regulatory conditions are met. Among other requirements, the code cannot be derived from or related to information about the individual, and it cannot otherwise be translated to identify that person; the re-identification mechanism must also be protected as the rule specifies. HHS notes separately that a cryptographic hash may be considered under Expert Determination when recipients are not given the keys. A hash is not automatically safe simply because it is a hash.
Properly de-identified information is no longer PHI under the Privacy Rule, but both methods leave some possibility of re-identification. A data use agreement may provide additional protections in some settings; it does not replace the requirements for Expert Determination.
Which method should an organization use?
The choice depends on the data and disclosure context, not on a rule that one method is inherently better. Safe Harbor provides a more prescriptive route when the organization can remove or generalize the specified details and can satisfy the separate no-actual-knowledge condition. Expert Determination can fit situations where a tailored assessment and mitigations can support the very-small-risk finding while preserving useful detail, but it requires appropriate expertise and documented analysis.
Organizations should select and apply the method that satisfies its legal test for the intended disclosure. A field’s usefulness, a contractual promise from a recipient, or the fact that information has been pseudonymized does not by itself establish HIPAA de-identification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
