The 18 HIPAA Identifiers: Safe Harbor PHI List

Once health data is de-identified under HIPAA, the Privacy Rule stops applying to it. That is the whole reason the standard matters commercially: 45 CFR 164.502(d) permits a covered entity to create de-identified information, and 164.514(a) says health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify one, is not individually identifiable. It is no longer protected health information, and the obligations come off.

There are exactly two ways to get there, and knowing which one you are on matters more than how thorough your redaction felt. Safe Harbor is a list. Expert Determination is an opinion. Everything below is about how each of them actually works, and which of the eighteen identifiers our own engine finds, including the ones it does not.

Safe Harbor lives at 164.514(b)(2) and it is refreshingly mechanical. Remove eighteen specified categories of identifier, covering the individual and also their relatives, employers and household members, and the result is de-identified by rule. There is no risk assessment to write and no statistician to hire. That is the appeal: it is auditable, it is repeatable, and two people applying it to the same record should reach the same output.

There is a second condition attached, and it is the one people skip. The covered entity must also have no actual knowledge that the remaining information could be used, alone or in combination, to identify the individual. Actual knowledge is a real limit rather than a formality. If you know that a particular record is the only case of a rare condition in a small dataset, stripping the eighteen fields does not make you finished, because you already know who it is.

Below is the full list, with the treatment each identifier requires and what our engine finds today. Read the coverage column against the gaps named further down.

Three of the eighteen are partial disclosures rather than deletions, and this is where de-identification work most often goes wrong, because a tool that blacks out the whole field is not compliant, it is merely destructive. Dates are the first. The rule keeps the year, so 14 March 1978 becomes 1978. Omit ships a year only operator for exactly this shape, alongside an initials operator for the same reason, rather than making you choose between the whole date and nothing.

Ages are the second, and the rule is oddly specific. All ages over 89 must be aggregated into a single category of 90 or above, along with all date elements indicating such an age. The logic is that the number of people alive at a given advanced age in a given area gets small enough to identify them. Omit detects ages, but not by default: age sits in the generic entity pack, appended only in the maximum and generalise coverage modes. Detection is also not the transformation the rule asks for, so the bucketing above 89 is still yours to do.

Postal codes are the third and the most misread, because the rule looks like a formatting preference and is actually a population threshold. The initial three digits of a ZIP code may be retained only if the geographic unit formed by all ZIP codes sharing those digits contains more than 20,000 people. Where it does not, they must be changed to 000. Which prefixes fail the threshold is maintained by the Department of Health and Human Services in its de-identification guidance, and it moves with the census. Omit detects postal codes and does not implement the three digit truncation with the population test, so that step is yours.

A limited data set is a different animal and gets mistaken for de-identified data constantly. Under 164.514(e) it is PHI with sixteen categories of direct identifier removed, but it may explicitly retain dates, including admission, discharge and date of birth, along with city, state, postal code and ages. That extra detail is the point, because it is what makes the data useful for research. The price is that a limited data set is still protected health information: it stays in scope, and may only be disclosed under a data use agreement that binds the recipient. Calling one anonymised is a category error with contractual consequences.

Expert Determination, at 164.514(b)(1), is the route for anyone who cannot afford what Safe Harbor removes. A person with appropriate knowledge of generally accepted statistical and scientific principles applies those methods, determines that the risk is very small that the information could be used alone or in combination to identify the individual, and documents the methods and results. Note what it is not: not a certification you buy once and reuse, and not a lower standard. It is a defensible opinion about a specific dataset released to a specific audience, and it usually costs more than Safe Harbor while preserving more value.

Now the honest account of our own coverage, tier by tier. Omit's Fast tier is the bundled default and needs no download. It covers names, geographic locations, the date family, telephone and fax numbers, email addresses, social security and other regional national identifiers, medical record numbers, web URLs, IP addresses, bank account numbers in IBAN form, and clinical codes. That is the majority of the eighteen, running offline on an ordinary machine.

The Accuracy tier adds the two that need a model rather than a pattern: device identifiers and biometric references. It also detects health conditions, medications and treatments, which are not among the eighteen at all but are special category data under the GDPR, so any team working to both regimes wants them found. The Fast tier comparison covers what each tier is and how they were measured.

The gaps, stated plainly, because a de-identification tool that overstates its coverage is worse than one that admits a hole. Account numbers are partial: bank accounts in IBAN form are detected, a generic account number in an unfamiliar format is not, and falls to the catch-all. Certificate and licence numbers are partial the same way, covered for German clinician licences with no general detector. Health plan beneficiary numbers cover the German statutory insurance number only. Vehicle identifiers are partial: VINs are detected and checksum validated, licence plates are not. Full face photographs are out of scope entirely: finding a face is a different problem from finding text, and we would rather say so than imply an image pass covers item seventeen.

PHI and PII are not synonyms, and the difference is worth one paragraph. PII is the general category of information that identifies a person. PHI is the narrower HIPAA category: identifying information that relates to health, care or payment for care, and that is held by a covered entity or a business associate. All PHI is PII, most PII is not PHI, and the eighteen identifiers are what turns the second definition into something you can actually execute. The same partial disclosure pattern shows up in litigation too, where Rule 5.2 keeps the last four digits of an account number and the year of a birth date for reasons that will now look familiar.

Which leaves the part of healthcare that no text based tool touches. Fax is still everywhere, referrals arrive as scans, and a photographed consent form is a photograph. A page with no text layer contains no text to remove, so a text based pass reports it perfectly clean while the patient's name sits in the pixels. Omit runs those through OCR and redacts the image regions directly, which handles printed text well and handwriting much less well. The same caution applies to a picture pasted inside a Word document, which a document pass does not read.

The last step is the one almost nothing does, which is checking. Removing a value is not hard; confirming it is gone from the file rather than covered by a shape is a separate operation, and verifying a redaction before it leaves your building is the difference between a de-identified record and a hope. If you are choosing between treatments, the vocabulary matters as well: redaction, anonymisation, pseudonymisation and de-identification are four different operations with four different legal consequences, and what redacted actually means is not what most tools deliver.

Omit Redact runs all of this on the clinician's own machine, with no upload, no account and no API key, which is the point when the data in question is a patient record. There is more on the workflow, and on what is certified against what is inherent by design, on the healthcare page, and on whether these identifiers belong in a chatbot in is ChatGPT HIPAA compliant.