De-identification turns protected health information into data you can use more freely. HIPAA recognises two methods to do it. Here is how each works and when to choose which.
TL;DR
HIPAA recognises two ways to de-identify PHI: Safe Harbor, which removes 18 specified identifiers, and Expert Determination, where a qualified expert confirms re-identification risk is very small. Once data is properly de-identified, it is no longer PHI and Privacy Rule restrictions no longer apply.
Safe Harbor is fast and checklist-based but strips detail; Expert Determination preserves more analytical value in exchange for expert analysis. For AI and advanced analytics, Expert Determination often fits better. Incomplete de-identification leaves the data as PHI.
On this page
Why de-identify PHI at all?
De-identification is powerful because of what it unlocks. Once health data is properly de-identified under HIPAA, it is no longer considered protected health information, which means the Privacy Rule‘s use and disclosure restrictions no longer apply. That opens the door to research, analytics, product development, and model training that would otherwise be tightly constrained. The catch is that de-identification has to be done to HIPAA’s standard, or the data remains PHI.
The two HIPAA de-identification methods
HIPAA recognises exactly two valid methods, defined in the Privacy Rule. Any approach that does not satisfy one of them does not produce de-identified data.
Method 1: Safe Harbor
Safe Harbor is the checklist approach. You remove all 18 specified identifiers from the data, including names, geographic detail smaller than a state, all date elements more specific than a year, contact details, and identifying numbers, and you must have no actual knowledge that the remaining information could identify an individual. It is fast, auditable, and low-effort.
Method 2: Expert Determination
Expert Determination is the risk-based approach. A person with appropriate statistical and scientific expertise analyses the data and formally determines that the risk of re-identifying an individual is very small, documenting the methods and justification. Because it is based on measured risk rather than a fixed checklist, it can retain far more detail, month-level dates or sub-state geography, while still meeting the standard.
Which method should you choose?
| Factor | Safe Harbor | Expert Determination |
|---|---|---|
| Approach | Fixed checklist of 18 identifiers | Statistical risk analysis by an expert |
| Speed and effort | Fast, low effort | Slower, needs expertise |
| Data detail retained | Lower | Higher |
| Best for | Simple sharing, basic reporting | Analytics, AI, longitudinal research |
As a rule of thumb: if you can tolerate the loss of precision, Safe Harbor is the quickest route to compliant de-identification. If your use case depends on retaining fine-grained detail, Expert Determination is usually the right path despite the added work.
The lean-team path around de-identified and identified data
De-identification decides which data escapes HIPAA’s scope, but the data that stays identified, and the systems that produce and store both, still need real protection and a clear boundary between the two. Managing that split, and proving where PHI does and does not flow, is where lean teams struggle across scattered tools.
Protect the PHI, prove the boundary.
Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Secure identified health data and evidence exactly where it flows, all on one platform mapped to HIPAA. No security team required.
Frequently asked questions
What does de-identification mean under HIPAA?
It is the process of modifying health data so an individual cannot be identified from it. Done to HIPAA’s standard, the result is no longer protected health information, so the Privacy Rule’s use and disclosure restrictions no longer apply.
What are the two HIPAA de-identification methods?
Safe Harbor, which removes 18 specified identifiers and requires no actual knowledge the rest could identify someone, and Expert Determination, where a qualified expert statistically confirms the re-identification risk is very small. Both are defined in the Privacy Rule.
What are the 18 Safe Harbor identifiers?
They include names, geographic detail smaller than a state, all dates more specific than a year, contact details such as phone and email, and identifying numbers like SSNs and record numbers, among others. All 18 must be removed for Safe Harbor to apply.
Which method is better for AI and analytics?
Expert Determination usually, because it preserves detail like month-level dates and sub-state geography that models and longitudinal studies rely on. Safe Harbor strips that precision, which can limit advanced analytics even though it is faster to apply.
Is de-identified data still regulated by HIPAA?
No. Properly de-identified data is no longer PHI and falls outside HIPAA’s use and disclosure restrictions. But if de-identification is incomplete and the data can still reasonably identify someone, it remains PHI and stays fully regulated.
Can I just remove names to de-identify data?
No. Removing a few fields does not meet either method. Safe Harbor requires all 18 identifiers removed with no knowledge the rest could identify anyone, and Expert Determination requires documented statistical analysis. Partial removal leaves the data as PHI.