Safe Harbor Method

Safe Harbor requires the absolute removal of 18 specific identifiers from the data set. These include direct identifiers like names, email addresses, and Social Security numbers, as well as quasi-identifiers like dates (except year) and geographic subdivisions smaller than a state. All 18 must be stripped for the data to be considered de-identified.

• Names and initials
• Geographic subdivisions smaller than a state
• All elements of dates (except year) directly related to an individual
• Telephone and fax numbers
• Email addresses and URLs
• Social Security and medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate/license numbers
• Vehicle identifiers and serial numbers
• Device identifiers and serial numbers
• Web Universal Resource Locators (URLs)
• Internet Protocol (IP) addresses
• Biometric identifiers (fingerprints, voice prints)
• Full-face photographs and comparable images
• Any other unique identifying number, characteristic, or code

Removing the 18 identifiers is necessary but not sufficient. The covered entity must also have no actual knowledge that the remaining information could be used, alone or in combination with other reasonably available data, to identify the individual. This is a subjective, ongoing obligation. If a data recipient informs the covered entity of a re-identification risk, the entity is deemed to have actual knowledge and the data is no longer considered safely de-identified under this method.

A covered entity can assign a code to de-identified data to allow for re-identification by the source, provided the code is not derived from or related to the individual's information. The code cannot be based on the individual's Social Security number or any other identifying attribute. The entity must also not disclose the mechanism for re-identification to the data recipient.

Safe Harbor is a prescriptive, rule-based method requiring the mechanical removal of 18 identifiers. In contrast, the Expert Determination method is a statistical approach where a qualified expert certifies that the risk of re-identification is 'very small.' Safe Harbor is simpler to implement but often results in lower data utility, as stripping all dates and geographic details can severely limit the analytical value of a clinical data set.

The most analytically destructive aspect of Safe Harbor is the treatment of dates and geography. All date elements except the year must be removed, meaning a patient's full date of birth, admission date, and discharge date are stripped. For geography, any unit smaller than a state (e.g., city, county, ZIP code) must be removed, unless the geographic unit contains more than 20,000 people, in which case the initial three digits of a ZIP code may be retained.

Applying Safe Harbor to structured data (e.g., database fields) is straightforward: drop the columns containing the 18 identifiers. The challenge lies in unstructured clinical text, such as physician notes and radiology reports. These narratives often contain embedded identifiers like physician names, hospital locations, and relative dates ('son John visited'). True Safe Harbor compliance requires a combination of named entity recognition (NER) and pattern matching to redact these identifiers from free text before the data set can be shared.