HIPAA Glossary · Data & information types
De-identification
Removing identifiers so information is no longer PHI and falls outside HIPAA. Two accepted methods: Expert Determination and Safe Harbor.
Context
De-identified information is not PHI, which means it can be used and disclosed freely. HIPAA recognises exactly two methods, defined at §164.514: Safe Harbor (remove the 18 enumerated identifier categories) and Expert Determination (statistical analysis). Shortcuts — "we removed names" — are neither method, and treating the result as de-identified is a common finding.
Related terms
- Safe Harbor (de-identification) — The de-identification method that removes 18 specified categories of identifiers, with no actual knowledge the remainder could identify the individual.
- Expert Determination — The alternative de-identification method: a qualified statistician determines the re-identification risk is very small and documents the analysis.
- PHI — Protected health information — individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.