HIPAA Safe Harbor: The 18 Identifiers and How to Apply Them

HIPAA Safe Harbor is one of two ways to de-identify protected health information (PHI) under the Privacy Rule. You remove 18 specified types of identifiers, and you must not have actual knowledge that what remains could identify a person. Data that meets the standard is no longer PHI, so the Privacy Rule does not restrict how you use or disclose it, according to HHS guidance on de-identification. This guide covers the full identifier list, the parts researchers most often get wrong, and how Safe Harbor compares with Expert Determination.

TL;DR

• Safe Harbor, defined at 45 CFR 164.514(b)(2), means removing 18 identifier types and having no actual knowledge that the remaining data could identify anyone.
• Dates keep only the year, ZIP codes are cut to three digits (and only for areas above 20,000 people), and ages over 89 collapse into “90 or older.”
• Removing the 18 identifiers is necessary but not always sufficient: rare diseases, free-text notes and small cells can still leave people recognizable.
• Expert Determination fits the method to your dataset through a documented statistical analysis, which costs more but keeps detail Safe Harbor strips out.
• Safe Harbor is a HIPAA standard only. It does not by itself settle the Common Rule or GDPR.

Table of Contents

• What Safe Harbor actually requires
• The 18 identifiers, in plain language
• The details that cause most mistakes
• The actual-knowledge requirement
• Safe Harbor vs. Expert Determination
• Safe Harbor does not settle everything
• A workflow for de-identifying a research dataset
• Where PlotStudio AI fits
• Perspective: de-identify for the question, not the checklist
• FAQ
• Sources

What Safe Harbor actually requires

The Privacy Rule offers two routes to de-identified data. One is Expert Determination. The other is Safe Harbor, which is a checklist: strip the listed identifiers of the individual and of relatives, employers and household members, and confirm you have no actual knowledge that the rest could identify someone. HHS describes both in its de-identification guidance.

Two consequences matter for researchers. First, once data meets the standard it falls outside the Privacy Rule, so you do not need an authorization or waiver to analyze it under HIPAA. Second, the standard is binary. A dataset either meets every element or it does not. There is no partial credit for removing 15 of the 18.

The 18 identifiers, in plain language

The list below follows the published summary of the 18 identifiers. The notes in the right column are where analysts tend to slip.

The last row is the one that trips up research teams. A study ID that is an encrypted or scrambled version of the MRN is still derived from an identifier. A randomly generated code with a separate, protected key is acceptable under the same published list.

The details that cause most mistakes

Dates

You may keep the year. Month and day go, for every date directly related to the person. That includes admission and discharge dates, lab dates and dates of death. For longitudinal studies this hurts, because intervals such as time to event are the whole analysis. A common workaround is to compute the interval (days from index admission to event) before release and keep only the interval. Check carefully that the interval itself, combined with other fields, does not recreate an identifying date.

Ages over 89

Ages over 89 are an identifier because so few people reach them. They can be aggregated into a single category of 90 or older, per the same identifier summary. If you model age as continuous, top-code it at 90 before analysis and note that choice in your methods.

Geography and the 20,000 rule

Anything smaller than a state is out, with one exception. You may keep the first three digits of a ZIP code only if the area those digits cover contains more than 20,000 people. Otherwise the three digits must be changed to 000, as HHS explains. A published evaluation of re-identification risk treats that 20,000-person threshold as significant for how distinctive a population is, which is a useful reminder that the rule exists because small areas make people findable.

Free text

Discharge summaries, progress notes and lab interpretations can contain names, dates and addresses in sentences. Whether free text must be redacted depends on the actual-knowledge standard, according to a Military Health System information paper on the HHS guidance. In practice, if you cannot confidently scrub a narrative field, drop it from the analytic dataset.

Codes and re-linking

You can assign a random code to let yourself re-link records later, provided it is not derived from an identifier and you do not disclose the mechanism. UCSF’s research protection office recommends coding or pseudonymizing the dataset and storing identifiers separately from the research data.

The actual-knowledge requirement

Safe Harbor has a second half that checklists often ignore. The covered entity must not have actual knowledge that the remaining information could identify an individual. The National Committee on Vital and Health Statistics clarifies that general awareness of re-identification research is not actual knowledge. Knowledge about your particular dataset is.

Examples of what can amount to actual knowledge, listed in the military health guidance, include:

• occupation data that points to one person (the only mayor in a small county, say)
• familial relationships recorded in the data
• a rare clinical event that is publicly known
• a recipient who already has an easy way to identify the person

A practical check: before release, sort every categorical variable by frequency and look at the smallest cells. If a single patient is the only one with a combination of diagnosis, year and region, you probably know something that Safe Harbor says you cannot ignore. UCSF also cautions that removing the identifiers may not be enough for distinctive data, such as rare diseases.

Safe Harbor vs. Expert Determination

Expert Determination is the alternative. A person with appropriate knowledge and experience applies accepted statistical and scientific principles, concludes that the risk of re-identification is very small, and documents the methods and results, as the NCVHS letter summarizes. The Privacy Rule neither defines expert qualifications nor endorses a set of methods, so the documentation carries the weight.

NCVHS describes Safe Harbor as largely one size fits all, while Expert Determination tailors the method to the dataset’s risks and is more consultative and expensive.

A third option: the Limited Data Set

If you need dates or town-level geography, a Limited Data Set removes a subset of 16 identifiers. Recipients must sign a data use agreement restricting how the data is used. It is still PHI, so it is not a de-identification method, but it is a common route for multi-site research.

Which one for your study?

• Choose Safe Harbor when you can live with year-level dates and coarse geography, and the data has no rare characteristics.
• Choose Expert Determination when time-to-event precision, small-area geography or rare disease cohorts are central to the science.
• Choose a Limited Data Set with a data use agreement when you need dates and trust the recipient contractually.

Safe Harbor does not settle everything

HIPAA is one layer. UCSF notes that Safe Harbor may not satisfy the Common Rule, which asks whether data are readily identifiable to the investigator. Your IRB decides that, so involve it early. UCSF also stresses that privacy belongs in the research lifecycle from planning, not as a last-minute scrub.

Outside the United States, the position differs. GDPR has its own concepts of anonymization and pseudonymization, and HIPAA compliance does not transfer automatically. If your study includes EU or UK participants, get advice from your data protection officer rather than assuming a HIPAA-style dataset is anonymous under European law.

A workflow for de-identifying a research dataset

1. Inventory the columns. Tag each variable against the 18 categories, including those hiding in free text, file names and metadata.
2. Decide what the analysis needs. If you need exact dates or small geographies, switch to Expert Determination or a Limited Data Set before you strip anything.
3. Transform, do not just delete. Convert dates to intervals, top-code ages at 90, truncate ZIP codes and map low-population prefixes to 000.
4. Replace keys. Assign random study IDs, and store the crosswalk separately with restricted access.
5. Check small cells. Review frequency tables for combinations that single out one person.
6. Document it. Record what you removed, the rules you used and who reviewed it. Your supervisor, reviewer or IRB will ask.
7. Re-run after changes. Any new variable or merge can undo the earlier work.

For deeper coverage, see our HIPAA de-identification playbook and our practitioner’s guide to data anonymization techniques.

Where PlotStudio AI fits

Steps 1 to 7 are where analysis time disappears, and where undocumented manual edits make results hard to reproduce. PlotStudio AI is agentic analytics for researchers: you connect tabular data and define an objective, and specialized agents plan the work, write and run real code, inspect intermediate results and document the analysis. Analyses can run locally on your machine, so datasets need not be uploaded to a conventional cloud analytics platform. Plan Mode lets you review and change the proposed approach before anything executes, which suits a de-identification step where you want to confirm each transformation. PlotStudio AI also includes PII detection and anonymization features, and exports notebooks and PDF reports so the steps can be inspected. It does not certify that a dataset meets Safe Harbor. That judgment stays with you, your privacy officer and your IRB.

PlotStudio AI sits alongside R, Python, Stata, SPSS, SAS and Jupyter rather than replacing them: those tools provide the statistical computing, and PlotStudio AI adds an agentic layer that can plan, execute, inspect and document complete analyses. Pricing as published: Bring Your Own Key is $39.99 per month, or $399.90 per year on the academic plan; Managed Credits is $69.99 per month. There is also a free trial. See current plans and the trial. For clinical teams, our guide to secure analytics for healthcare researchers explains the local workflow in more detail.

Perspective: de-identify for the question, not the checklist

We see the same pattern in clinical research groups. A team scrubs a dataset to the letter of the 18 identifiers, hands it to an analyst, and discovers weeks later that the analysis needed exact intervals, or that a rare-diagnosis subgroup is now small enough to be recognizable. The checklist was followed. The study was still compromised.

Our view is that de-identification is a methodological decision, written down like any other. Which variables are coarsened, why, and what that does to power and interpretation belongs in the analysis plan, reviewed before code runs. That is why we built PlotStudio AI around reviewable plans and reproducible outputs. A supervisor or reviewer should be able to see that ages were top-coded at 90, that dates became intervals, and that small cells were examined, instead of taking it on trust. Keeping the data on the researcher’s machine reduces one exposure, and an auditable trail addresses the other.

Privacy-first analysis is not a late step. It is part of the design. Our privacy-first analytics guide for academic research goes further on that approach.

— Aymen

FAQ

Is HIPAA Safe Harbor the same as the 18 identifiers list?

The 18 identifiers are the core of Safe Harbor, but not the whole method. You must also have no actual knowledge that the remaining information could identify a person. Both conditions have to be met.

Can I keep the year of birth under Safe Harbor?

Yes, you may keep the year for dates directly related to an individual, with one exception: ages over 89 must be aggregated into a 90-or-older category. That means birth years that imply an age over 89 cannot stay.

Is a random study ID allowed?

Yes. The list excludes a random code that is not related to or derived from an existing identifier. A code built from a patient’s MRN, initials or birth date does not qualify.

Does de-identified data under Safe Harbor count as anonymous under GDPR?

Not automatically. Safe Harbor is a HIPAA standard, and GDPR applies its own tests for anonymization. If your data involves European participants, ask your data protection officer before treating it as anonymous.

When should I choose Expert Determination instead?

Choose it when your analysis needs details that Safe Harbor removes, such as exact dates, small-area geography or rare conditions. It requires a qualified expert to document that the re-identification risk is very small, so it costs more than the checklist.

Sources

• HHS: Guidance Regarding Methods for De-identification of PHI
• California CDII: Information about HIPAA Definitions and 18 Identifiers
• NCVHS: Recommendations on De-identification of Protected Health Information
• Military Health System: New Guidance on De-Identification Methods under the HIPAA Privacy Rule
• UCSF HRPP: De-identification and Confidentiality of Research Data
• PMC: Evaluating re-identification risks with respect to the HIPAA Privacy Rule
• PMC: Modes of De-identification

Recommended

• Secure Analytics for Healthcare Researchers: Local Agentic Workflows
• Data Anonymization Techniques: A Practitioner’s Guide
• HIPAA De-Identification: A Compliance Officer’s Playbook