Two ways to meet one rule
HIPAA's de-identification rule, 45 CFR 164.514(b), gives you two ways to make health information stop counting as identifiable: Safe Harbor and Expert Determination. Pick the wrong one and you either strip out the detail your analysts need, or you carry risk you did not mean to carry.
Safe Harbor: remove 18 kinds of identifiers
Under Safe Harbor you remove 18 kinds of identifiers. They come off for the person, and for their relatives, employers and household members too.
The list: names; geographic units smaller than a state, including street address, city, county and ZIP code; every part of a date except the year, for dates tied to the person, such as birth, admission, discharge and death; phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers and license plates; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers such as finger and voice prints; full face photos and comparable images; and any other unique identifying number, characteristic or code.
Two details catch teams out.
ZIP codes: you may keep the first three digits only when that three-digit area holds more than 20,000 people under current Census data. At 20,000 or fewer, those three digits become 000.
Ages: any age over 89 has to go, though you may group all of them as 90 or older.
One more condition sits on top of the list. You cannot have actual knowledge that what is left could identify someone.
Expert Determination: show the risk is very small
Here, a person with knowledge of and experience with generally accepted statistical and scientific methods looks at your data. They determine that the risk is very small that the anticipated recipient could identify someone, alone or combined with other reasonably available information. They write down the methods and the results.
How to choose
Safe Harbor is a checklist. It is predictable and needs no outside expert. The price is detail: dates, geography and free text lose what your analysts often need.
Expert Determination keeps more of the useful detail when the expert's analysis supports it. The price is the expert's work and the documentation behind it.
If your data feeds analytics or AI, and the dates and places matter, Expert Determination is usually worth it. If you need something clean and simple for a one-time share, Safe Harbor is often enough.
The step both methods depend on
Real records name the same person many ways. "Maria Delgado" in one file, "M. Delgado" in a scan, "Mria" in a typed note. Treat those as three people and two things go wrong. One version slips through and leaks, or your counts stop adding up.
Link every version of a person to one stand-in first. Then remove.
Keeping a way back
The rule allows a re-identification code, under 164.514(c), only if the code is not derived from or related to information about the person, and you never disclose how to reverse it. That rules out codes generated from the name itself. Use random IDs, kept in a locked table that only you control.
Where we come in
We de-identify your data inside your own walls, to Safe Harbor or alongside your expert for Expert Determination, with every version of a name linked to one stand-in. Book a review, bring a sample, and we'll show you what comes out.
