WhatsApp and Telegram +44 7563 115980
[email protected]
How health information is de-identified under the HIPAA Privacy Rule, using either the Safe Harbor method or Expert Determination, and what that means for health data licensed to train or test AI models.
Since 2013 we have helped firms with due diligence and data services, in more than 60 countries.
The short answer
Under the HIPAA Privacy Rule, health information is de-identified, and no longer protected health information, if it meets one of two methods. Safe Harbor removes 18 listed types of identifier about the patient and their relatives, employers and household members, with no actual knowledge that what remains could identify anyone. Expert Determination relies on a qualified expert who finds, and documents, that the risk of identification by an anticipated recipient is very small. The Privacy Rule does not restrict the use or disclosure of properly de-identified information, but contracts and state law, including California's rules on deidentified patient information, still apply.
On this page
HIPAA is the US federal law that protects health information. Its Privacy Rule applies to covered entities, meaning health plans, health care clearinghouses and health care providers that conduct certain transactions electronically, and to their business associates, meaning companies that handle protected health information on their behalf, such as billing or technology providers.
Protected health information (PHI) is individually identifiable health information held by those organisations. Health information that has been de-identified under one of the two methods in 45 CFR 164.514(b) is not individually identifiable, so it is not PHI, and the Privacy Rule does not restrict its use or disclosure.
A business associate may de-identify PHI only to the extent its business associate agreement with the covered entity authorises it. That agreement must be checked before any health data is prepared for licensing.
Under Safe Harbor, the following identifiers of the individual or of their relatives, employers or household members must be removed, and the covered entity must have no actual knowledge that the remaining information could identify the individual.
| Identifier | What the rule requires |
|---|---|
| 1. Names | Removed |
| 2. Geographic subdivisions smaller than a state | Street address, city, county, precinct and ZIP code removed. The first three digits of a ZIP code may stay only if all ZIP codes sharing them cover more than 20,000 people; otherwise they become 000 |
| 3. Dates | All elements of dates except the year removed for dates directly related to the individual, such as birth, admission, discharge and death. Ages over 89 are grouped as 90 or older |
| 4. to 6. Telephone, fax and email | Removed |
| 7. to 11. Identifying numbers | Social Security, medical record, health plan beneficiary, account, and certificate or licence numbers removed |
| 12. and 13. Vehicle and device identifiers | Vehicle identifiers and serial numbers, including licence plates, and device identifiers and serial numbers removed |
| 14. and 15. Web addresses and IP addresses | URLs and IP address numbers removed |
| 16. Biometric identifiers | Including finger and voice prints, removed |
| 17. Full-face photographs | And any comparable images, removed |
| 18. Any other unique code | Any other unique identifying number, characteristic or code removed, except a permitted re-identification code |
HHS (the US Department of Health and Human Services) lists 17 three-digit ZIP codes that fell below the 20,000 threshold in the 2000 Census, and warns that organisations should not rely on that list where newer census data has been published.
Removing the 18 identifiers is not enough if the organisation actually knows the rest could identify someone. HHS defines actual knowledge as clear and direct knowledge that the remaining information could be used, alone or with other information, to identify the person. Its examples include a rare occupation recorded with the data, a recipient who is a relative of the patient, and a widely reported rare clinical event. General awareness that re-identification research exists does not count.
Free text matters most for AI training data. HHS states that the standard makes no distinction between data in structured fields and information entered as free text: any identifier must be removed wherever it appears. Clinical notes, messages and transcripts therefore need review for names, dates, places and other details written in ordinary sentences, as well as context that could trigger actual knowledge.
AI datasets raise identifiers that tabular data rarely does. Medical images can include full-face photographs or comparable images, and identifying text embedded in the image or its file details. Recorded consultations can carry voice prints, which are biometric identifiers. System logs can include device serial numbers, web addresses and IP addresses. Each must be found and removed under Safe Harbor, or assessed by the expert under Expert Determination.
We run de-identification inside your environment, review free text and images, and document the method and results for buyers and auditors.
Speak to an expertData de-identificationUnder Expert Determination, a person with appropriate knowledge of and experience with generally accepted statistical and scientific methods applies those methods, determines that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results.
Expert Determination suits AI training data well because it can keep detail that Safe Harbor would remove, such as exact dates or finer geography, where the expert shows the risk remains very small for the specific buyer.
| Safe Harbor | Expert Determination | |
|---|---|---|
| Basis | Removal of 18 identifier types plus no actual knowledge | Statistical analysis of risk for an anticipated recipient |
| Data utility | Lower: dates reduced to years and geography to state or three-digit ZIP | Higher: detail kept where the risk stays very small |
| Who performs it | The covered entity or its authorised business associate | A qualified expert, with documented methods |
| Depends on recipient | No | Yes: the analysis is tied to who receives the data |
| Best for | Simple structured datasets, broad release | Rich datasets, free text, longitudinal records, specific licensees |
Safe Harbor, which removes 18 listed identifier types with no actual knowledge that the rest could identify anyone, and Expert Determination, where a qualified expert documents that the identification risk is very small for an anticipated recipient.
Names; geography smaller than a state; date elements except year; telephone and fax numbers; email; Social Security, medical record, health plan, account and licence numbers; vehicle and device identifiers; URLs; IP addresses; biometrics; full-face photographs; and any other unique code.
No. Health information de-identified under either method is not individually identifiable, so it is not protected health information and the Privacy Rule does not restrict its use or disclosure.
A person with appropriate knowledge of and experience with generally accepted statistical and scientific methods. HHS states there is no specific degree or certification required.
The HIPAA Privacy Rule does not restrict the use or disclosure of properly de-identified information. Contracts, state laws such as California's rules on deidentified patient information, and the business associate agreement still apply.
Only to the extent its business associate agreement with the covered entity authorises it.
Only the first three digits, and only where all ZIP codes sharing those digits cover more than 20,000 people according to current census data. Otherwise they must be changed to 000.
A limited data set keeps some dates and geography, remains PHI and needs a data use agreement for research, public health or health care operations. De-identified data is not PHI.
The Privacy Rule does not require an expiry date, though experts may set a time limit after which the determination is reviewed.
No. It applies to covered entities, meaning health plans, health care clearinghouses and providers that conduct certain transactions electronically, and to their business associates. Health data held by other companies follows general privacy law.
Each point of law and each reported figure on this page was checked against these sources on 27 October 2026. This page is general information, not legal advice.
Tell us about the health data you hold and how it will be used.