HIPAA Safe Harbor: the 18 identifiers you must remove to de-identify data

HIPAA Safe Harbor is a de-identification method that treats health data as no longer protected once 18 specified categories of identifier are removed — from names and geographic detail down to any other unique identifying code — provided you have no actual knowledge the remaining data could still identify someone. It is defined in the HIPAA Privacy Rule at 45 CFR §164.514(b)(2), and it is the checklist-driven alternative to the statistical Expert Determination method. Remove all 18 and the data falls outside HIPAA’s restrictions on use and disclosure.

TL;DR

• Safe Harbor requires removing 18 identifier categories (§164.514(b)(2)(i)) and having no actual knowledge that the remainder could re-identify a person (§164.514(b)(2)(ii)).
• It is one of two de-identification routes; the other is Expert Determination (§164.514(b)(1)), a statistical risk assessment.
• Dates are stripped to the year; ages over 89 are aggregated into a single “90+” category.
• Geography is cut to the first three digits of the ZIP code (and only if the population of that area exceeds 20,000).
• The last category — any other unique identifying number, characteristic, or code — is a catch-all, so a mechanical 17-item pass is not enough.

What is HIPAA Safe Harbor?

Safe Harbor is one of the two ways the HIPAA Privacy Rule lets you de-identify protected health information (PHI) so it is no longer subject to the Rule. Instead of a statistician’s judgement, it gives you a fixed list: remove these 18 categories of identifier about the individual, their relatives, employers, and household members, and — absent actual knowledge to the contrary — the result is de-identified.

The 18 HIPAA Safe Harbor identifiers

1. Names
2. Geographic subdivisions smaller than a state — street address, city, county, precinct, ZIP code (you may keep the first three ZIP digits if the area has more than 20,000 people)
3. Dates (except year) directly related to the individual — birth date, admission, discharge, death; and all ages over 89
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers, including license plates
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers, including fingerprints and voiceprints
17. Full-face photographs and any comparable images
18. Any other unique identifying number, characteristic, or code

Safe Harbor vs Expert Determination

	Safe Harbor	Expert Determination
Basis	Fixed 18-identifier checklist	Statistical/scientific analysis
Who signs off	Anyone applying the list	A qualified expert
Reg reference	§164.514(b)(2)	§164.514(b)(1)
Data utility	Lower (dates/geo coarsened)	Can be higher (risk-based)
Best when	You want a repeatable, defensible rule	You need to retain fine-grained data

Safe Harbor is predictable and cheap to apply; Expert Determination preserves more analytic value but needs documented expertise and a formal risk finding.

The “actual knowledge” caveat

Removing the 18 categories is necessary but not automatically sufficient. §164.514(b)(2)(ii) adds that the covered entity must have no actual knowledge that the remaining information could be used, alone or in combination, to identify an individual. If you know a particular rare combination still points to one patient, Safe Harbor is not satisfied — which is the same re-identification problem that GDPR raises. (See re-identification risk.)

Before / after

Before (PHI):
  John Smith, DOB 1954-03-11, 42 Main St, Boston MA 02118,
  MRN 88213, SSN 123-45-6789, admitted 2026-02-02, age 72

After (Safe Harbor de-identified):
  [NAME], born [YEAR:1954], [ZIP3:021xx], MRN [REMOVED],
  SSN [REMOVED], admitted [YEAR:2026], age 72

Note what survives: the year and an age under 90 are allowed; the street, full ZIP, MRN and SSN are not.

FAQ

Does Safe Harbor apply outside the US? It is a US HIPAA concept for health data. In the EU the equivalent question is whether data is “anonymous” under GDPR Recital 26 — a different, risk-based test. See does GDPR apply to anonymized data.

Can I keep the year of a date? Yes. Only elements of a date more specific than the year must be removed, except that all ages over 89 must be aggregated to “90 or older.”

Is removing 17 of the 18 enough? No. All categories must be handled, including the catch-all 18th — any other unique code or characteristic that could identify someone.

Is Safe Harbor the same as anonymization? Conceptually similar (both aim to break identifiability) but they are different legal standards. Safe Harbor is a fixed checklist; GDPR anonymization is a reasonableness test.

Do biometric identifiers really count? Yes — fingerprints, voiceprints and full-face images are explicitly listed and must be removed.

---

Amaze detects and masks direct identifiers — names, national IDs, emails, phone numbers, account and record numbers — entirely on your own machine, so PHI never leaves your environment during de-identification. See how it works.

Part of our complete guide to data anonymization.