HIPAA Identifiers: What De-identification Requires

Removing a patient’s name is only a first step in assessing health information for de-identification. Dates, locations, and numbers may still point to a person. The 18 identifier categories under HIPAA form the removal part of the Safe Harbor method; the organization must also consider whether it has actual knowledge that the remaining information could identify someone.

HIPAA 18 Identifiers: The Safe Harbor Categories

The HHS guidance on de-identification describes two methods under the Privacy Rule. For Safe Harbor, the HIPAA 18 identifiers include information about the individual and the individual’s relatives, employers, or household members. The categories to remove, subject to the exceptions described below, are:

1. Names.
2. Geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and equivalent geocodes.
3. Elements of dates directly related to an individual, other than year, and ages over 89 and date elements indicative of such age.
4. Telephone numbers.
5. Fax numbers.
6. Email addresses.
7. Social Security numbers.
8. Medical record numbers.
9. Health plan beneficiary numbers.
10. Account numbers.
11. Certificate or license numbers.
12. Vehicle identifiers and serial numbers, including license plate numbers.
13. Device identifiers and serial numbers.
14. Web URLs.
15. Internet Protocol addresses.
16. Biometric identifiers, including fingerprints and voiceprints.
17. Full-face photographs and comparable images.
18. Any other unique identifying number, characteristic, or code, subject to the permitted re-identification code provisions.

These 18 categories of HIPAA identifiers apply to recognizable identifiers wherever they appear in a record. A spreadsheet may have clearly labeled columns, while a clinical note may contain a telephone number or an address in ordinary sentences. Both structured fields and free text need attention. An inventory of the data sources and formats helps the responsible team decide how each will be reviewed.

Dates, Age, and Geography Need Particular Care

For dates directly related to an individual, Safe Harbor generally permits the year but removes other elements, such as the month and day of birth, admission, discharge, or death. There is a stricter rule for people older than 89: ages over 89 and date elements, including the year, that indicate such an age must be removed. They may instead be grouped into a single category of age 90 or older. A full birth date in a note cannot be retained merely because a separate date-of-birth column has been removed.

Geography below the state level is generally removed. The first three digits of a ZIP code may be retained if the geographic unit formed by all ZIP codes sharing those digits has more than 20,000 residents, according to current publicly available Census Bureau data. For a unit with 20,000 or fewer residents, those three digits must be changed to 000. HHS advises using the most current publicly available Census data rather than relying on an old list of restricted prefixes.

Consider a record that retains a year of admission and a state. Those fields may be useful for analysis, but the rest of the record also matters. A detailed account of an unusual, widely reported event could make a person recognizable even after direct fields have been removed. A review should consider the combination of details and what the covered entity knows about the intended disclosure.

Two Methods, Different Decisions

Safe Harbor combines the specified removal rules with a separate condition: the covered entity must not have actual knowledge that the remaining information could identify a subject, either alone or in combination with other information. HHS describes actual knowledge as clear and direct knowledge. For example, an organization may know that the recipient can recognize a person from an unusual event described in a record. In that case, removing the listed categories alone does not satisfy Safe Harbor.

Expert Determination takes a different route. A person with appropriate knowledge and experience applies generally accepted statistical and scientific principles and determines that the risk is very small that an anticipated recipient could identify a subject using the information alone or with other reasonably available information. The expert must document the methods and results supporting that determination. The method does not simply require applying the Safe Harbor list; its decisions depend on the expert’s analysis of the data and anticipated recipient.

Both approaches can reduce identification risk, but HHS notes that risk is not zero. The choice can also affect how much detail remains available for research or analysis. A responsible privacy specialist can explain the method selected, the review performed, and whether additional rules or organizational policies apply to the intended use.

Questions Before Sharing a Dataset

A review of HIPAA patient identifiers is more useful when it covers the actual file, including attachments and narrative fields. Before sharing, the data owner can ask the responsible privacy or legal specialist:

• Which de-identification method applies, and who is responsible for the decision?
• Have patient identifiers under HIPAA been reviewed in free text as well as labeled fields?
• Do dates, ages, and ZIP prefixes meet the relevant Safe Harbor conditions if that method is used?
• Does the organization have actual knowledge that remaining details could identify someone?
• If an expert made the determination, where are the methods and results documented?