De-identification

A prescriptive, checklist-based approach requiring the removal of 18 specific identifiers from the data set. These identifiers include names, geographic subdivisions smaller than a state, all elements of dates (except year) directly related to an individual, telephone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers and serial numbers including license plates, device identifiers and serial numbers, URLs, IP addresses, biometric identifiers including finger and voice prints, full-face photographic images and any comparable images, and any other unique identifying number, characteristic, or code. The covered entity must also have no actual knowledge that the remaining information could be used alone or in combination to identify the individual.

A statistical approach where a qualified expert applies generally accepted statistical and scientific principles to determine that the risk of re-identification is very small. The expert must document the methods and results of the analysis that justify this determination. This method allows for the retention of certain identifiers that would be prohibited under Safe Harbor, provided the expert can demonstrate that the data, alone or in combination with other reasonably available information, poses a minimal re-identification risk. The expert must consider factors such as the degree of uniqueness of the remaining data elements and the availability of external data sources that could be used for re-identification.

The Safe Harbor method mandates the removal of these specific identifiers:

• Names of individuals, relatives, employers, or household members
• Geographic subdivisions smaller than a state (street address, city, county, precinct, ZIP code with initial three digits if population > 20,000)
• All date elements (except year) directly related to an individual: birth date, admission date, discharge date, date of death, and all ages over 89
• Telephone and fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers including license plate numbers
• Device identifiers and serial numbers
• Web URLs
• IP addresses
• Biometric identifiers including finger and voice prints
• Full-face photographic images and any comparable images
• Any other unique identifying number, characteristic, or code

A Limited Data Set (LDS) is PHI that excludes only 16 of the 18 Safe Harbor identifiers, retaining dates and geographic information. It is not fully de-identified and remains subject to HIPAA. Use requires a Data Use Agreement (DUA) between the covered entity and recipient, specifying permitted uses and disclosures, and prohibiting re-identification. LDS is commonly used for research, public health, and healthcare operations where temporal or geographic analysis is necessary but full PHI is not required.

Under both methods, the covered entity must not have actual knowledge that the remaining information could identify the individual. De-identified data may be re-identified only through a specific process using a re-identification code assigned by the covered entity, which must not be derived from or related to the individual's information. Any attempt to re-identify de-identified data outside this process is a violation of HIPAA and may incur civil and criminal penalties. The increasing availability of large public datasets and advanced linkage algorithms makes re-identification risk assessment a dynamic, ongoing challenge.

The choice between Safe Harbor and Expert Determination depends on the intended use of the data. Safe Harbor is simpler and provides a clear compliance path but results in significant data loss, potentially destroying clinical utility. Expert Determination preserves richer data for research and analytics but requires a qualified statistical expert and a documented, defensible methodology. For AI and machine learning applications in healthcare, Expert Determination is often preferred to retain the granularity needed for model training, provided the re-identification risk is demonstrably very small.