HIPAA Glossary · Data & information types
Safe Harbor (de-identification)
The de-identification method that removes 18 specified categories of identifiers, with no actual knowledge the remainder could identify the individual.
Context
The 18 categories at §164.514(b)(2): names, dates more specific than year, geographic units smaller than a state (with limited zip-code allowances), contact details, identifying numbers (SSN, medical record, account, licence, device IDs), biometrics, photographs, and other unique identifying characteristics. "No actual knowledge" is a real test; it is not met by uploading obviously identifiable data minus a column.
Related terms
- De-identification — Removing identifiers so information is no longer PHI and falls outside HIPAA. Two accepted methods: Expert Determination and Safe Harbor.
- Expert Determination — The alternative de-identification method: a qualified statistician determines the re-identification risk is very small and documents the analysis.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.