What Is De-Identified Health Information Under HIPAA?

De-identified health information neither identifies an individual nor provides a reasonable basis to identify one, and it is not protected health information. HIPAA recognizes two methods: the Safe Harbor method, which removes 18 listed identifier categories and requires no actual knowledge that the remaining information could identify the individual, and the Expert Determination method, in which a qualified expert finds the risk of re-identification very small.

Standard. 45 CFR 164.514(a) sets the de-identification standard, and 164.514(b) describes the two methods for meeting it.

Expert Determination (164.514(b)(1)). A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results.

Safe Harbor (164.514(b)(2)). The 18 identifiers of the individual, and of relatives, employers, or household members, are removed. They include names, geographic subdivisions smaller than a state (limited three-digit ZIP retention is subject to the rule's Census population conditions), all elements of dates (except year) directly related to the individual, and all ages over 89 and date elements indicative of those ages unless aggregated as age 90 or older, phone and fax numbers, email addresses, Social Security numbers, medical record and health plan numbers, account and license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs and any comparable images, and any other unique identifying number, characteristic, or code. The covered entity also must not have actual knowledge that the remaining information could be used, alone or in combination with other information, to identify the individual.

Re-identification codes. A covered entity may assign a code for re-identification if the code is not derived from or related to information about the individual and cannot otherwise be translated to identify the individual, the covered entity does not use or disclose the code for any other purpose, and it does not disclose the re-identification mechanism (164.514(c)).

Residual risk. HHS guidance describes the remaining risk under either method as very small, not zero.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."