Safe Harbor De-identification

The first tier of Safe Harbor requires stripping all names and geographic subdivisions smaller than a state. This includes patient names, relatives' names, employer names, street addresses, city, county, precinct, and ZIP codes. The only exception: the initial three digits of a ZIP code may be retained if the geographic unit contains more than 20,000 people. For synthetic data generators, this means the latent space must not encode or reconstruct these fields.

• Names: Full name, last name, first name, initials
• Geography: Street address, city, county, precinct, ZIP code (except first 3 digits if population > 20,000)
• Synthetic implication: GANs must be audited for ZIP code leakage via correlated features

All date elements directly related to an individual must be removed, except the year. This includes birth date, admission date, discharge date, and date of death. Ages over 89 must be aggregated into a single category of '90 or older' because the intersection of advanced age with sparse geographic data creates re-identification risk. For synthetic EHR generation, temporal sequence preservation must not inadvertently reconstruct exact dates.

• Dates: Birth, admission, discharge, death, procedure dates
• Age restriction: All ages > 89 must be collapsed to '90+'
• Year retention: Year alone is permissible for aggregate analysis

A broad category covering all electronic and telecommunication contact points. This includes telephone numbers, fax numbers, email addresses, URLs, and IP addresses. In modern healthcare AI, IP addresses are particularly critical because they can be cross-referenced with geolocation databases to re-identify patients. Synthetic data pipelines must ensure no device-level or network-layer metadata persists in generated records.

• Telephone & fax numbers: All formats, including extensions
• Email addresses: Personal and institutional
• IP addresses: IPv4 and IPv6, static or dynamic
• URLs: Personal websites, social media profiles

This category covers official identification numbers issued by government agencies and institutions. Social Security numbers, medical record numbers, health plan beneficiary numbers, and account numbers must all be stripped. Certificate and license numbers—including driver's licenses and professional licenses—are also covered. For synthetic data, these high-cardinality identifiers are typically replaced with surrogate keys that preserve relational integrity without retaining the original values.

• Social Security numbers: Full or partial
• Medical record numbers: Hospital-assigned patient IDs
• Health plan numbers: Insurance beneficiary identifiers
• Account numbers: Billing and financial accounts
• Certificate/license numbers: Driver's license, DEA, professional licenses

The final category addresses physical and digital device markers that can uniquely identify an individual. This includes medical device serial numbers, implant identifiers, and biometric data such as fingerprints, retinal scans, and voice prints. Full-face photographic images and comparable images are also explicitly covered. In synthetic medical imaging, generative models must not reproduce facial features from CT/MRI scans that could enable facial recognition.

• Device serial numbers: Implants, prosthetics, monitoring equipment
• Biometric identifiers: Fingerprints, voice prints, retinal scans
• Full-face images: Photographs and comparable images
• Synthetic imaging concern: Defacing algorithms must be validated on generated DICOM data

The 18th identifier is a catch-all provision covering any other unique identifying characteristic, code, or number not explicitly listed in the previous 17 categories. This forward-looking clause captures emerging identifiers such as genomic sequences, blockchain-based health IDs, and digital phenotyping signatures. For synthetic data governance, this means privacy assessments must evolve as new re-identification vectors emerge from advances in multi-modal AI and data linkage technologies.

• Emerging identifiers: Genomic data, digital phenotypes, wearable signatures
• Re-identification risk: Cross-referencing synthetic data with public datasets
• Governance requirement: Continuous privacy auditing as technology evolves

The Safe Harbor method requires the removal of 18 specific identifiers to consider data de-identified. These range from direct identifiers like names and social security numbers to quasi-identifiers such as all elements of dates (except year) and full-face photographic images. Any unique identifying number, characteristic, or code must also be stripped. The covered entity must have no actual knowledge that the remaining information could be used alone or in combination to identify the individual.

A privacy metric that measures the difficulty of distinguishing real from synthetic records by comparing distances to nearest neighbors. The process:

1. For each synthetic record, find its nearest neighbor in the real dataset.
2. For each real record, find its nearest neighbor in the synthetic dataset.
3. Calculate the adversarial accuracy—how often a classifier can correctly label records as real or synthetic. An NNAA score near 0.5 indicates strong privacy, meaning the synthetic data does not simply replicate real individuals.

The degree to which synthetic medical data adheres to established physiological constraints and medical ontologies like SNOMED CT. Safe Harbor de-identification alone does not guarantee plausibility—removing identifiers can still leave behind clinically impossible combinations (e.g., a male patient with ovarian cancer). High-quality synthetic generation must preserve:

• Realistic disease progression pathways
• Valid drug-disease interactions
• Consistent temporal trajectories Plausibility is essential for the data's utility in clinical research.