The 18 HIPAA Identifiers and Safe Harbor

Once health data is de-identified under HIPAA, the Privacy Rule stops applying to it. That is the whole reason the standard matters commercially: 45 CFR 164.502(d) permits a covered entity to create de-identified information, and 164.514(a) says health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify one, is not individually identifiable. It is no longer protected health information, and the obligations come off.

There are exactly two ways to get there, and knowing which one you are on matters more than how thorough your redaction felt. Safe Harbor is a list. Expert Determination is an opinion. Everything below is about how each of them actually works, and which of the eighteen identifiers our own engine finds, including the ones it does not.

Safe Harbor lives at 164.514(b)(2) and it is refreshingly mechanical. Remove eighteen specified categories of identifier, covering the individual and also their relatives, employers and household members, and the result is de-identified by rule. There is no risk assessment to write and no statistician to hire. That is the appeal: it is auditable, it is repeatable, and two people applying it to the same record should reach the same output.

There is a second condition attached, and it is the one people skip. The covered entity must also have no actual knowledge that the remaining information could be used, alone or in combination, to identify the individual. Actual knowledge is a real limit rather than a formality. If you know that a particular record is the only case of a rare condition in a small dataset, stripping the eighteen fields does not make you finished, because you already know who it is.

The eighteen are listed below with the treatment each requires and what our engine currently does with it. Read the coverage column with the caveat that follows it further down: this is what ships today, gaps included.

Three of the eighteen are partial disclosures rather than deletions, and this is where de-identification work most often goes wrong, because a tool that blacks out the whole field is not compliant, it is merely destructive. Dates are the first. The rule keeps the year, so 14 March 1978 becomes 1978. Omit ships an operator for exactly this shape rather than making you choose between the whole date and nothing: the year only treatment reduces the value and leaves the record usable, and it exists alongside an initials operator for the same reason.

Ages are the second, and the rule is oddly specific. All ages over 89 must be aggregated into a single category of 90 or above, along with all date elements indicating such an age. The logic is that the number of people alive at a given advanced age in a given area gets small enough to identify them. Omit can detect ages, but not in its default configuration: age sits in the generic entity pack, which is appended only in the maximum and generalise coverage modes, not in the standard one. And detection is not the same as the transformation the rule asks for. Bucketing everything above 89 into one category is a step you currently have to take yourself.

Postal codes are the third and the most misread, because the rule looks like a formatting preference and is actually a population threshold. The initial three digits of a ZIP code may be retained only if the geographic unit formed by all ZIP codes with those same three digits contains more than 20,000 people. Where it does not, those three digits must be changed to 000. The list of which prefixes fail the threshold is maintained by the Department of Health and Human Services in its de-identification guidance, and it changes with the census. We state this as the rule rather than as a feature: Omit detects postal codes, and it does not currently implement the three digit truncation with the population test, so that step is yours.

A limited data set is a different animal and gets mistaken for de-identified data constantly. Under 164.514(e) it is PHI with sixteen categories of direct identifier removed, but it is explicitly allowed to retain dates, including admission and discharge and date of birth, and city, state and postal code, and ages. That extra detail is the point, because it is what makes the data useful for research. The price is that a limited data set is still protected health information. It stays in scope, and it may only be disclosed under a data use agreement that binds the recipient. If someone hands you a limited data set and calls it anonymised, that is a category error with contractual consequences.

Expert Determination, at 164.514(b)(1), is the route for anyone who cannot afford what Safe Harbor removes. A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles applies those methods, determines that the risk is very small that the information could be used alone or in combination to identify the individual, and documents the methods and the results of the analysis. Note what it is not: it is not a certification you buy once and reuse, and it is not a lower standard. It is a defensible opinion about a specific dataset released to a specific audience, and it usually costs more than Safe Harbor and preserves more value.

Now the honest account of our own coverage, tier by tier. Omit's Fast tier is the bundled default and needs no download. It covers names, geographic locations, the date family, telephone and fax numbers, email addresses, social security and other regional national identifiers, medical record numbers, web URLs, IP addresses, bank account numbers in IBAN form, and clinical codes. That is the majority of the eighteen, running offline on an ordinary machine.

The Accuracy tier adds the two that need a model rather than a pattern: device identifiers and biometric references. It also detects health conditions, medications and treatments, which are not among the eighteen at all but are special category data under the GDPR, so any team working to both regimes wants them found. The Fast tier comparison covers what each tier is and how they were measured.

The gaps, stated plainly, because a de-identification tool that overstates its coverage is worse than one that admits a hole. Account numbers are partial: bank accounts in IBAN form are detected, a generic account number in an unfamiliar format is not, and falls to the catch-all. Certificate and licence numbers are partial in the same way, with clinician licence numbers covered for Germany specifically and no general detector. Health plan beneficiary numbers are covered for the German statutory insurance number only, with other countries not yet implemented. Vehicle identifiers are partial: vehicle identification numbers are detected and checksum validated, licence plates are not. Full face photographs are out of scope entirely, because finding a face in an image is a different problem from finding text, and we would rather say so than imply an image pass covers item seventeen. And ages, as described above, need a coverage mode change and still leave the bucketing to you.

PHI and PII are not synonyms, and the difference is worth one paragraph. PII is the general category of information that identifies a person. PHI is the narrower HIPAA category: identifying information that relates to health, care or payment for care, and that is held by a covered entity or a business associate. All PHI is PII, most PII is not PHI, and the eighteen identifiers are what turns the second definition into something you can actually execute. The same partial disclosure pattern shows up in litigation too, where Rule 5.2 keeps the last four digits of an account number and the year of a birth date for reasons that will now look familiar.

Which leaves the part of healthcare that no text based tool touches. Fax is still everywhere, referrals arrive as scans, and a photographed consent form is a photograph. A page with no text layer contains no text to remove, so a text based pass will report it perfectly clean while the patient's name sits in the pixels. Omit runs those through OCR and redacts the image regions directly, which handles printed text well and handwriting much less well, and clinical handwriting least of all. The same caution applies to a picture pasted inside a Word document, which a document pass does not read.

The last step is the one almost nothing does, which is checking. Removing a value is not hard; confirming it is gone from the file rather than covered by a shape is a separate operation, and verifying a redaction before it leaves your building is the difference between a de-identified record and a hope. If you are choosing between treatments, the vocabulary matters as well: redaction, anonymisation, pseudonymisation and de-identification are four different operations with four different legal consequences, and what redacted actually means is not what most tools deliver.

Omit Redact runs all of this on the clinician's own machine, with no upload, no account and no API key, which is the point when the data in question is a patient record. There is more on the workflow, and on what is certified against what is inherent by design, on the healthcare page.