De-Identification of PHI: Safe Harbor vs Expert Determination | Osto<\/title>\n<meta name=\"description\" content=\"How to de-identify PHI under HIPAA: the Safe Harbor and Expert Determination methods, the 18 identifiers, trade-offs, and when data stops being PHI.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">De-identification turns protected health information into data you can use more freely. HIPAA recognises two methods to do it. Here is how each works and when to choose which.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>HIPAA recognises two ways to de-identify PHI: Safe Harbor, which removes 18 specified identifiers, and Expert Determination, where a qualified expert confirms re-identification risk is very small. Once data is properly de-identified, it is no longer PHI and Privacy Rule restrictions no longer apply.<\/p>\n <p>Safe Harbor is fast and checklist-based but strips detail; Expert Determination preserves more analytical value in exchange for expert analysis. For AI and advanced analytics, Expert Determination often fits better. Incomplete de-identification leaves the data as PHI.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why de-identify<\/a><\/li>\n <li><a href=\"#methods\">The two methods<\/a><\/li>\n <li><a href=\"#safeharbor\">Safe Harbor<\/a><\/li>\n <li><a href=\"#expert\">Expert Determination<\/a><\/li>\n <li><a href=\"#choose\">Which to choose<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">Why de-identify PHI at all?<\/h2>\n <p>De-identification is powerful because of what it unlocks. Once health data is properly de-identified under HIPAA, it is no longer considered <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\/\">protected health information<\/a>, which means the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-privacy-rule\/\">Privacy Rule<\/a>‘s use and disclosure restrictions no longer apply. That opens the door to research, analytics, product development, and model training that would otherwise be tightly constrained. The catch is that de-identification has to be done to HIPAA’s standard, or the data remains PHI.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The payoff, and the condition<\/div>Correctly de-identified data falls outside HIPAA’s restrictions entirely. But partial or informal removal of a few fields does not qualify, if the data can still reasonably identify someone, it is still PHI and still fully regulated.<\/div>\n\n <h2 class=\"sec\" id=\"methods\">The two HIPAA de-identification methods<\/h2>\n <p>HIPAA recognises exactly two valid methods, defined in the Privacy Rule. Any approach that does not satisfy one of them does not produce de-identified data.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">Two ways to de-identify<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">HIPAA recognises exactly two methods<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M8 6h12M8 12h12M8 18h12\"\/><path d=\"M4 6h.01M4 12h.01M4 18h.01\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Safe Harbor<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Remove all 18 specified identifiers, and hold no knowledge the rest could re-identify.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M4 20V4\"\/><path d=\"M4 20h16\"\/><rect x=\"7\" y=\"12\" width=\"3\" height=\"5\"\/><rect x=\"12\" y=\"8\" width=\"3\" height=\"9\"\/><rect x=\"17\" y=\"14\" width=\"3\" height=\"3\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Expert Determination<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">A qualified expert statistically confirms re-identification risk is very small.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M6.3 6.3l11.4 11.4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Then it is not PHI<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Once properly de-identified, HIPAA Privacy Rule restrictions no longer apply.<\/div>\n <\/div><\/div>\n<\/div>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">How de-identification works<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Two paths, one outcome<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Both methods take PHI and, done correctly, produce data that is no longer protected health information under HIPAA.<\/div>\n <svg viewBox=\"0 0 710 165\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"PHI de-identified via Safe Harbor or Expert Determination becomes non-PHI\">\n<defs><marker id=\"hdArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <rect x=\"30\" y=\"60\" width=\"170\" height=\"70\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"1.8\"\/>\n <text x=\"115\" y=\"90\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">PHI<\/text>\n <text x=\"115\" y=\"110\" fill=\"#5b6178\" font-size=\"10.5\">restricted by Privacy Rule<\/text>\n <rect x=\"265\" y=\"45\" width=\"170\" height=\"45\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"350\" y=\"66\" fill=\"#0a7d6c\" font-size=\"12\" font-weight=\"800\">Safe Harbor<\/text>\n <text x=\"350\" y=\"81\" fill=\"#5b6178\" font-size=\"9.5\">remove 18 identifiers<\/text>\n <rect x=\"265\" y=\"100\" width=\"170\" height=\"45\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"350\" y=\"121\" fill=\"#3a46c0\" font-size=\"12\" font-weight=\"800\">Expert Determination<\/text>\n <text x=\"350\" y=\"136\" fill=\"#5b6178\" font-size=\"9.5\">statistical risk analysis<\/text>\n <rect x=\"500\" y=\"60\" width=\"180\" height=\"70\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.8\"\/>\n <text x=\"590\" y=\"90\" fill=\"#0a7d6c\" font-size=\"14\" font-weight=\"800\">De-identified<\/text>\n <text x=\"590\" y=\"110\" fill=\"#5b6178\" font-size=\"10.5\">no longer PHI<\/text>\n <line x1=\"200\" y1=\"88\" x2=\"262\" y2=\"70\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n <line x1=\"200\" y1=\"100\" x2=\"262\" y2=\"120\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n <line x1=\"435\" y1=\"68\" x2=\"498\" y2=\"86\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n <line x1=\"435\" y1=\"122\" x2=\"498\" y2=\"104\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n<\/g><\/svg>\n \n<\/div>\n\n <h2 class=\"sec\" id=\"safeharbor\">Method 1: Safe Harbor<\/h2>\n <p>Safe Harbor is the checklist approach. You remove all 18 specified identifiers from the data, including names, geographic detail smaller than a state, all date elements more specific than a year, contact details, and identifying numbers, and you must have no actual knowledge that the remaining information could identify an individual. It is fast, auditable, and low-effort.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">What Safe Harbor gives up in detail<\/div>Safe Harbor strips precision: dates collapse to the year, geography to the state, and ages above 89 group into a single “90 or older” category. That simplicity is why it is easy to apply, and also why it can weaken data for detailed analysis.<\/div>\n\n <h2 class=\"sec\" id=\"expert\">Method 2: Expert Determination<\/h2>\n <p>Expert Determination is the risk-based approach. A person with appropriate statistical and scientific expertise analyses the data and formally determines that the risk of re-identifying an individual is very small, documenting the methods and justification. Because it is based on measured risk rather than a fixed checklist, it can retain far more detail, month-level dates or sub-state geography, while still meeting the standard.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">When the extra effort pays off<\/div>Expert Determination requires specialised analysis and documentation, but it preserves the temporal and geographic detail that machine learning and longitudinal research depend on. For data-hungry use cases, that retained utility is often worth the added rigour.<\/div>\n\n <h2 class=\"sec\" id=\"choose\">Which method should you choose?<\/h2>\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Factor<\/th><th>Safe Harbor<\/th><th>Expert Determination<\/th><\/tr>\n <tr><td><strong>Approach<\/strong><\/td><td>Fixed checklist of 18 identifiers<\/td><td>Statistical risk analysis by an expert<\/td><\/tr>\n <tr><td><strong>Speed and effort<\/strong><\/td><td>Fast, low effort<\/td><td>Slower, needs expertise<\/td><\/tr>\n <tr><td><strong>Data detail retained<\/strong><\/td><td>Lower<\/td><td>Higher<\/td><\/tr>\n <tr><td><strong>Best for<\/strong><\/td><td>Simple sharing, basic reporting<\/td><td>Analytics, AI, longitudinal research<\/td><\/tr>\n <\/table><\/div>\n\n <p>As a rule of thumb: if you can tolerate the loss of precision, Safe Harbor is the quickest route to compliant de-identification. If your use case depends on retaining fine-grained detail, Expert Determination is usually the right path despite the added work.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path around de-identified and identified data<\/h2>\n <p>De-identification decides which data escapes HIPAA’s scope, but the data that stays identified, and the systems that produce and store both, still need real protection and a clear boundary between the two. Managing that split, and proving where PHI does and does not flow, is where lean teams struggle across scattered tools.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Encryption, access control, and audit logging run on one platform and produce evidence automatically over the systems that hold PHI, so you can protect identified data, demonstrate the boundary with de-identified data, and stay mapped to HIPAA alongside 200+ other frameworks. That clarity is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Protect the PHI, prove the boundary.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Secure identified health data and evidence exactly where it flows, all on one platform mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What does de-identification mean under HIPAA?<\/summary><p>It is the process of modifying health data so an individual cannot be identified from it. Done to HIPAA’s standard, the result is no longer protected health information, so the Privacy Rule’s use and disclosure restrictions no longer apply.<\/p><\/details>\n <details><summary>What are the two HIPAA de-identification methods?<\/summary><p>Safe Harbor, which removes 18 specified identifiers and requires no actual knowledge the rest could identify someone, and Expert Determination, where a qualified expert statistically confirms the re-identification risk is very small. Both are defined in the Privacy Rule.<\/p><\/details>\n <details><summary>What are the 18 Safe Harbor identifiers?<\/summary><p>They include names, geographic detail smaller than a state, all dates more specific than a year, contact details such as phone and email, and identifying numbers like SSNs and record numbers, among others. All 18 must be removed for Safe Harbor to apply.<\/p><\/details>\n <details><summary>Which method is better for AI and analytics?<\/summary><p>Expert Determination usually, because it preserves detail like month-level dates and sub-state geography that models and longitudinal studies rely on. Safe Harbor strips that precision, which can limit advanced analytics even though it is faster to apply.<\/p><\/details>\n <details><summary>Is de-identified data still regulated by HIPAA?<\/summary><p>No. Properly de-identified data is no longer PHI and falls outside HIPAA’s use and disclosure restrictions. But if de-identification is incomplete and the data can still reasonably identify someone, it remains PHI and stays fully regulated.<\/p><\/details>\n <details><summary>Can I just remove names to de-identify data?<\/summary><p>No. Removing a few fields does not meet either method. Safe Harbor requires all 18 identifiers removed with no knowledge the rest could identify anyone, and Expert Determination requires documented statistical analysis. Partial removal leaves the data as PHI.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>De-Identification of PHI: Safe Harbor vs Expert Determination | Osto De-identification turns protected health information into data you can use\u2026<\/p>\n","protected":false},"author":8,"featured_media":881,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[360,362,363,361],"class_list":["post-880","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-de-identification-of-phi","tag-expert-determination","tag-hipaa-de-identification","tag-safe-harbor-method"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=880"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/880\/revisions"}],"predecessor-version":[{"id":882,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/880\/revisions\/882"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/881"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":880,"date":"2026-08-17T07:14:37","date_gmt":"2026-08-17T07:14:37","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=880"},"modified":"2026-08-17T07:14:37","modified_gmt":"2026-08-17T07:14:37","slug":"hipaa-de-identification-of-phi","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-de-identification-of-phi\/","title":{"rendered":"De-Identification of PHI: Safe Harbor vs Expert Determination"},"content":{"rendered":"\n\n\n\n\n\nDe-Identification of PHI: Safe Harbor vs Expert Determination | Osto<\/title>\n<meta name=\"description\" content=\"How to de-identify PHI under HIPAA: the Safe Harbor and Expert Determination methods, the 18 identifiers, trade-offs, and when data stops being PHI.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">De-identification turns protected health information into data you can use more freely. HIPAA recognises two methods to do it. Here is how each works and when to choose which.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>HIPAA recognises two ways to de-identify PHI: Safe Harbor, which removes 18 specified identifiers, and Expert Determination, where a qualified expert confirms re-identification risk is very small. Once data is properly de-identified, it is no longer PHI and Privacy Rule restrictions no longer apply.<\/p>\n <p>Safe Harbor is fast and checklist-based but strips detail; Expert Determination preserves more analytical value in exchange for expert analysis. For AI and advanced analytics, Expert Determination often fits better. Incomplete de-identification leaves the data as PHI.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why de-identify<\/a><\/li>\n <li><a href=\"#methods\">The two methods<\/a><\/li>\n <li><a href=\"#safeharbor\">Safe Harbor<\/a><\/li>\n <li><a href=\"#expert\">Expert Determination<\/a><\/li>\n <li><a href=\"#choose\">Which to choose<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"why\">Why de-identify PHI at all?<\/h2>\n <p>De-identification is powerful because of what it unlocks. Once health data is properly de-identified under HIPAA, it is no longer considered <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\/\">protected health information<\/a>, which means the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-privacy-rule\/\">Privacy Rule<\/a>‘s use and disclosure restrictions no longer apply. That opens the door to research, analytics, product development, and model training that would otherwise be tightly constrained. The catch is that de-identification has to be done to HIPAA’s standard, or the data remains PHI.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The payoff, and the condition<\/div>Correctly de-identified data falls outside HIPAA’s restrictions entirely. But partial or informal removal of a few fields does not qualify, if the data can still reasonably identify someone, it is still PHI and still fully regulated.<\/div>\n\n <h2 class=\"sec\" id=\"methods\">The two HIPAA de-identification methods<\/h2>\n <p>HIPAA recognises exactly two valid methods, defined in the Privacy Rule. Any approach that does not satisfy one of them does not produce de-identified data.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">Two ways to de-identify<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">HIPAA recognises exactly two methods<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M8 6h12M8 12h12M8 18h12\"\/><path d=\"M4 6h.01M4 12h.01M4 18h.01\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Safe Harbor<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Remove all 18 specified identifiers, and hold no knowledge the rest could re-identify.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M4 20V4\"\/><path d=\"M4 20h16\"\/><rect x=\"7\" y=\"12\" width=\"3\" height=\"5\"\/><rect x=\"12\" y=\"8\" width=\"3\" height=\"9\"\/><rect x=\"17\" y=\"14\" width=\"3\" height=\"3\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Expert Determination<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">A qualified expert statistically confirms re-identification risk is very small.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"8\"\/><path d=\"M6.3 6.3l11.4 11.4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Then it is not PHI<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Once properly de-identified, HIPAA Privacy Rule restrictions no longer apply.<\/div>\n <\/div><\/div>\n<\/div>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">How de-identification works<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Two paths, one outcome<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Both methods take PHI and, done correctly, produce data that is no longer protected health information under HIPAA.<\/div>\n <svg viewBox=\"0 0 710 165\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"PHI de-identified via Safe Harbor or Expert Determination becomes non-PHI\">\n<defs><marker id=\"hdArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <rect x=\"30\" y=\"60\" width=\"170\" height=\"70\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"1.8\"\/>\n <text x=\"115\" y=\"90\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">PHI<\/text>\n <text x=\"115\" y=\"110\" fill=\"#5b6178\" font-size=\"10.5\">restricted by Privacy Rule<\/text>\n <rect x=\"265\" y=\"45\" width=\"170\" height=\"45\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"350\" y=\"66\" fill=\"#0a7d6c\" font-size=\"12\" font-weight=\"800\">Safe Harbor<\/text>\n <text x=\"350\" y=\"81\" fill=\"#5b6178\" font-size=\"9.5\">remove 18 identifiers<\/text>\n <rect x=\"265\" y=\"100\" width=\"170\" height=\"45\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"350\" y=\"121\" fill=\"#3a46c0\" font-size=\"12\" font-weight=\"800\">Expert Determination<\/text>\n <text x=\"350\" y=\"136\" fill=\"#5b6178\" font-size=\"9.5\">statistical risk analysis<\/text>\n <rect x=\"500\" y=\"60\" width=\"180\" height=\"70\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.8\"\/>\n <text x=\"590\" y=\"90\" fill=\"#0a7d6c\" font-size=\"14\" font-weight=\"800\">De-identified<\/text>\n <text x=\"590\" y=\"110\" fill=\"#5b6178\" font-size=\"10.5\">no longer PHI<\/text>\n <line x1=\"200\" y1=\"88\" x2=\"262\" y2=\"70\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n <line x1=\"200\" y1=\"100\" x2=\"262\" y2=\"120\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n <line x1=\"435\" y1=\"68\" x2=\"498\" y2=\"86\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n <line x1=\"435\" y1=\"122\" x2=\"498\" y2=\"104\" stroke=\"#5b64c8\" stroke-width=\"2\" marker-end=\"url(#hdArr)\"\/>\n<\/g><\/svg>\n \n<\/div>\n\n <h2 class=\"sec\" id=\"safeharbor\">Method 1: Safe Harbor<\/h2>\n <p>Safe Harbor is the checklist approach. You remove all 18 specified identifiers from the data, including names, geographic detail smaller than a state, all date elements more specific than a year, contact details, and identifying numbers, and you must have no actual knowledge that the remaining information could identify an individual. It is fast, auditable, and low-effort.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">What Safe Harbor gives up in detail<\/div>Safe Harbor strips precision: dates collapse to the year, geography to the state, and ages above 89 group into a single “90 or older” category. That simplicity is why it is easy to apply, and also why it can weaken data for detailed analysis.<\/div>\n\n <h2 class=\"sec\" id=\"expert\">Method 2: Expert Determination<\/h2>\n <p>Expert Determination is the risk-based approach. A person with appropriate statistical and scientific expertise analyses the data and formally determines that the risk of re-identifying an individual is very small, documenting the methods and justification. Because it is based on measured risk rather than a fixed checklist, it can retain far more detail, month-level dates or sub-state geography, while still meeting the standard.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">When the extra effort pays off<\/div>Expert Determination requires specialised analysis and documentation, but it preserves the temporal and geographic detail that machine learning and longitudinal research depend on. For data-hungry use cases, that retained utility is often worth the added rigour.<\/div>\n\n <h2 class=\"sec\" id=\"choose\">Which method should you choose?<\/h2>\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Factor<\/th><th>Safe Harbor<\/th><th>Expert Determination<\/th><\/tr>\n <tr><td><strong>Approach<\/strong><\/td><td>Fixed checklist of 18 identifiers<\/td><td>Statistical risk analysis by an expert<\/td><\/tr>\n <tr><td><strong>Speed and effort<\/strong><\/td><td>Fast, low effort<\/td><td>Slower, needs expertise<\/td><\/tr>\n <tr><td><strong>Data detail retained<\/strong><\/td><td>Lower<\/td><td>Higher<\/td><\/tr>\n <tr><td><strong>Best for<\/strong><\/td><td>Simple sharing, basic reporting<\/td><td>Analytics, AI, longitudinal research<\/td><\/tr>\n <\/table><\/div>\n\n <p>As a rule of thumb: if you can tolerate the loss of precision, Safe Harbor is the quickest route to compliant de-identification. If your use case depends on retaining fine-grained detail, Expert Determination is usually the right path despite the added work.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path around de-identified and identified data<\/h2>\n <p>De-identification decides which data escapes HIPAA’s scope, but the data that stays identified, and the systems that produce and store both, still need real protection and a clear boundary between the two. Managing that split, and proving where PHI does and does not flow, is where lean teams struggle across scattered tools.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Encryption, access control, and audit logging run on one platform and produce evidence automatically over the systems that hold PHI, so you can protect identified data, demonstrate the boundary with de-identified data, and stay mapped to HIPAA alongside 200+ other frameworks. That clarity is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Protect the PHI, prove the boundary.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Secure identified health data and evidence exactly where it flows, all on one platform mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What does de-identification mean under HIPAA?<\/summary><p>It is the process of modifying health data so an individual cannot be identified from it. Done to HIPAA’s standard, the result is no longer protected health information, so the Privacy Rule’s use and disclosure restrictions no longer apply.<\/p><\/details>\n <details><summary>What are the two HIPAA de-identification methods?<\/summary><p>Safe Harbor, which removes 18 specified identifiers and requires no actual knowledge the rest could identify someone, and Expert Determination, where a qualified expert statistically confirms the re-identification risk is very small. Both are defined in the Privacy Rule.<\/p><\/details>\n <details><summary>What are the 18 Safe Harbor identifiers?<\/summary><p>They include names, geographic detail smaller than a state, all dates more specific than a year, contact details such as phone and email, and identifying numbers like SSNs and record numbers, among others. All 18 must be removed for Safe Harbor to apply.<\/p><\/details>\n <details><summary>Which method is better for AI and analytics?<\/summary><p>Expert Determination usually, because it preserves detail like month-level dates and sub-state geography that models and longitudinal studies rely on. Safe Harbor strips that precision, which can limit advanced analytics even though it is faster to apply.<\/p><\/details>\n <details><summary>Is de-identified data still regulated by HIPAA?<\/summary><p>No. Properly de-identified data is no longer PHI and falls outside HIPAA’s use and disclosure restrictions. But if de-identification is incomplete and the data can still reasonably identify someone, it remains PHI and stays fully regulated.<\/p><\/details>\n <details><summary>Can I just remove names to de-identify data?<\/summary><p>No. Removing a few fields does not meet either method. Safe Harbor requires all 18 identifiers removed with no knowledge the rest could identify anyone, and Expert Determination requires documented statistical analysis. Partial removal leaves the data as PHI.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>De-Identification of PHI: Safe Harbor vs Expert Determination | Osto De-identification turns protected health information into data you can use\u2026<\/p>\n","protected":false},"author":8,"featured_media":881,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[360,362,363,361],"class_list":["post-880","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-de-identification-of-phi","tag-expert-determination","tag-hipaa-de-identification","tag-safe-harbor-method"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=880"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/880\/revisions"}],"predecessor-version":[{"id":882,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/880\/revisions\/882"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/881"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}