Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Before sharing health data for research, decide what information the recipient will receive, which privacy rules apply, and how you will justify the release. Under U.S. HIPAA, the legal term is de-identification, and HHS recognizes two routes: Safe Harbor and Expert Determination. Neither means a dataset is impossible to re-identify; the goal is a documented release decision that fits the data and sharing context.
What does “anonymize” mean under HIPAA?
“Anonymize” is common shorthand, but HIPAA uses de-identification and sets a specific standard. The regulation says health information is not individually identifiable when it does not identify a person and there is no reasonable basis to believe it can be used to identify that person. HHS describes two methods for meeting HIPAA’s de-identification standard: Safe Harbor and Expert Determination. See the HIPAA regulation text and HHS OCR’s de-identification guidance, issued November 26, 2012.
As an Amazon Associate I earn from qualifying purchases.
This article addresses U.S. HIPAA guidance. Whether HIPAA applies—and what other privacy, research, institutional, contractual, or jurisdictional requirements apply—depends on the project. HIPAA de-identification alone does not settle every approval or permission question.
Free tools Windows power users keep installed
One-click scans. No signup required.
How should you decide whether a dataset is ready to share?
Use a release decision process rather than treating name removal as the finish line. The recipient and the information reasonably available to them matter, particularly when assessing risk under Expert Determination.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- Define the release. Record who holds the data, who will receive it, the research purpose, and whether access will be public, governed by an agreement, or limited to a controlled environment.
- Confirm the applicable rules. Determine whether HIPAA applies and check separately for IRB or Privacy Board review, Common Rule, FDA, institutional, contractual, and other jurisdictional requirements. HHS explains that HIPAA and human-subjects protections can operate separately; consult its overview of HIPAA privacy standards.
- Choose and apply a HIPAA route. Use Safe Harbor if its specified removals and conditions fit the dataset and research need. Consider Expert Determination when a qualified person can assess the release in context and document the result.
- Review remaining fields and combinations. Consider whether values left in the dataset, alone or combined with reasonably available outside information, could identify someone to the anticipated recipient.
- Minimize and protect the release. Keep only the fields needed for the research, restrict access and transfer, and govern any retained linkage mechanism.
- Record the decision. Keep the method, responsible person, dataset version, transformations, assumptions, recipient context, and approval or release decision together.
- Reassess if the context changes. A new recipient, public release, new linkage information, or changed dataset can alter the risk assessment. This follows from the contextual nature of the standard; HHS does not set a universal numeric reassessment threshold.
How do Safe Harbor and Expert Determination differ?
Both are HIPAA de-identification methods, but they reach the standard differently. HHS OCR guidance and the regulatory text do not establish one method as universally better.
| Decision point | Safe Harbor | Expert Determination |
|---|---|---|
| Method | Remove the identifiers specified by the rule and meet its additional conditions. | A qualified person applies generally accepted statistical and scientific principles to determine that identification risk is very small. |
| Who carries it out | The covered entity applies the regulatory specification. | A person with appropriate knowledge and experience makes the determination. |
| Role of context | The prescribed rule applies, including the condition that the covered entity have no actual knowledge that remaining information could identify the person. | The assessment considers the anticipated recipient and reasonably available information. |
| Documentation | Keep evidence that the specified identifiers and conditions were addressed. | Document the methods and results supporting the conclusion. |
| Research detail | Removing or generalizing information to meet the specification may reduce analytic detail. | A tailored assessment may evaluate a particular release, but does not guarantee that every useful detail can be retained. |
For the complete requirements, consult the regulation text and HHS OCR guidance.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
What does Safe Harbor require?
Safe Harbor is not simply deleting names. It requires removal of the identifiers specified in the HIPAA rule and compliance with additional conditions. The rule includes details and exceptions, so do not rely on a partial checklist as if it were the complete standard. Review the full text of 45 CFR § 164.514 and document how the release meets it.
One important condition is that the covered entity must not have actual knowledge that the remaining information could identify an individual. If the prescribed removals and conditions do not fit the release or the research need, consider whether an Expert Determination is appropriate instead.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
When is Expert Determination appropriate?
Expert Determination is a contextual risk assessment, not a label produced by removing fields or running an automated process. A person with appropriate statistical and scientific expertise must determine that the risk is very small that the information could identify someone, alone or in combination with other reasonably available information, when used by the anticipated recipient. The expert must document the methods and results supporting that conclusion.
This route may be useful when the dataset or research purpose makes a prescribed removal approach unsuitable. It does not authorize a blanket claim that any chosen detail is safe to disclose: the assessment must address the particular information, recipient, and available external information. HHS OCR describes this method in its guidance on de-identification.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Is removing names enough to protect a health dataset?
No. Direct identifiers are only part of the assessment. Remaining values and combinations can matter when considered alongside information reasonably available to the recipient. Review the proposed release as a whole in its actual sharing context, rather than evaluating each field in isolation.
- Ask what the recipient can access or reasonably obtain outside the dataset.
- Check whether combinations of retained values could distinguish or identify a person.
- Remove or generalize fields that are not needed for the research, while weighing their analytic value against the release risk.
- Consider whether public access creates a different context from access under an agreement or in a controlled environment.
These are practical review steps, not a substitute for applying one of HIPAA’s two methods. The HIPAA standard is not a promise of zero risk or irreversible anonymization.
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
Can coded health data be shared for research?
Coded records are not automatically anonymous. HIPAA has conditions for retaining a code with de-identified information, including that the code not be derived from or related to information about the individual and that the mechanism for re-identification not be disclosed. Review the applicable requirements in the HIPAA regulation text.
As a practical control, separate the key or linkage mechanism from the research dataset, restrict who can access it, and document how it is protected. HHS Office for Human Research Protections explains that coded private information or biospecimens may be treated differently depending on who can readily ascertain identities and the circumstances; its guidance was last reviewed December 30, 2022. See OHRP guidance on coded information and biospecimens. HIPAA’s coded-data conditions and Common Rule concepts are not interchangeable.
Does HIPAA de-identification make IRB review unnecessary?
Not by itself. A HIPAA de-identification decision answers a HIPAA privacy question; it does not automatically determine whether a project is human-subjects research, whether IRB or Privacy Board review is needed, or whether another rule, agreement, or institutional policy applies. HHS distinguishes HIPAA privacy requirements from human-subjects protections in its HIPAA standards overview. Have the responsible institutional office assess the project under the rules that apply to it.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
