HIPAA Safe Harbor
By Gareth HoyleLast updated How we research
HIPAA Safe Harbor is the de-identification method that removes 18 listed identifiers from health data, leaving data no longer covered by the Privacy Rule.
HIPAA Safe Harbor is one of the two methods the HIPAA Privacy Rule accepts for de-identifying protected health information, set out in 45 CFR 164.514(b)(2). It requires removal of 18 types of identifiers of the individual and of relatives, employers and household members, and no actual knowledge that the remaining data could identify anyone.
What does Safe Harbor remove?
The 18 identifiers include names, addresses smaller than a state, all date elements except year, phone numbers, email addresses, Social Security numbers, medical record numbers, device identifiers, IP addresses, biometric identifiers and full-face photos. HHS guidance allows the first three ZIP code digits only where that area has more than 20,000 people, and ages over 89 must be grouped as 90 or older.
Is Safe Harbor enough for AI training data?
Safe Harbor is a clear standard, but free text such as clinical notes often hides identifiers that a field-by-field method misses. Many sellers use Expert Determination for notes and images instead. Data de-identified under either method is no longer protected health information. Our medical practices page covers what buyers check.
UK and EU law has no equivalent checklist. Data is anonymous only if a person cannot be identified by any means reasonably likely to be used.