HIPAA de-identification: the Safe Harbor method and the 18 identifiers, column by column

HIPAA de-identification has two methods. The Safe Harbor method removes eighteen kinds of identifiers. This guide maps each to the columns you will find in a patient or client spreadsheet, and explains the dates, postal codes and codes that cause most mistakes.

Clinics, billing offices, research teams and health plans hold spreadsheets that list patients, visits, claims and results. When someone in such an organization wants an AI assistant to find a pattern in one of these files, the first question is what the privacy rule says about the data.

This guide is about one part of that answer: the list of eighteen identifiers in the United States federal privacy rule for health information, commonly called the HIPAA Privacy Rule. It shows what each item looks like as a spreadsheet column, which ones the rule treats with special conditions, and which ones are easy to miss. It does not decide whether your file meets the rule.

Key terms

HIPAA: the Health Insurance Portability and Accountability Act, the US law behind the federal rules on the privacy of health information.
Covered entity: the kind of organization the rule applies to, such as a health plan, a health care clearinghouse or a health care provider that sends certain information electronically. The regulations define the term, and your privacy officer can tell you whether you are one.
De-identified: health information that the rule treats as no longer identifying an individual, because it meets one of the rule's two methods.
Expert determination: the first of the two methods. A qualified person analyzes the file and documents why the risk of identifying anyone is very small.
Safe Harbor method: the common name of the second method, which removes the eighteen listed identifiers.
Identifier: one of the eighteen kinds of value the rule lists. They include the individual's own and those of relatives, employers and household members.
Stand-in: a made-up label used in place of a real value, such as PATIENT_017.

Does this rule apply to you?

The rule is written for covered entities, a term the regulations define. If you work for a clinic, a hospital, an insurer or a company that handles claims or records for them, ask your privacy officer whether your organization is covered, or is bound through an agreement with one that is. If it is not, other laws and agreements may still apply to your files, but the eighteen-item list is not your rule.

What are the two ways to de-identify health information?

The standard in the rule says that health information that does not identify an individual, and for which there is no reasonable basis to believe that it can be used to identify one, is not individually identifiable health information. The rule gives a covered entity two ways to decide that health information meets that standard.

Expert determination. A person with appropriate knowledge of statistical and scientific methods analyzes the file. That person decides that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify someone. The person then documents the method and the result.
Removal of identifiers (the Safe Harbor method). All eighteen listed identifiers are removed, and the organization does not have actual knowledge that what remains could be used alone or with other information to identify a person.

Most spreadsheet work uses the second method, because it is concrete. It has two conditions, and removing the columns satisfies only the first.

Which columns are the eighteen identifiers?

The rule's list also covers the identifiers of the individual's relatives, employers and household members, so a column for a guarantor, a next of kin or an employer needs the same attention as the patient's own.

	The rule's identifier	Where you will find it in a spreadsheet	What DataAttendant's built-in detection does
A	Names	Patient name, guarantor, next of kin, provider notes	Recognizes name columns by heading, and looks for names in values
B	Geographic units smaller than a state	Street address, city, county, ZIP code	Recognizes address and postal code headings; check city and county columns yourself
C	Dates, except the year, that relate to the person; ages over 89	Birth date, admission, discharge, appointment, death date, age	Recognizes birth dates; check the treatment of every other date column, because a date that is not a birth date may be kept as it is
D	Telephone numbers	Phone, mobile, home phone	Recognizes phone headings and number values
E	Fax numbers	Fax	Recognizes the heading "fax", as a phone number
F	Email addresses	Email, patient portal login	Recognizes email values and headings
G	Social security numbers	SSN	Recognizes headings such as SSN and social security number
H	Medical record numbers	MRN, chart number	No type of its own; long numbers and codes may be suggested as internal identifiers
I	Health plan beneficiary numbers	Member ID, policy number	No type of its own; may be suggested as an internal identifier
J	Account numbers	Account number, claim account, bank account	Recognizes IBANs and payment card numbers; other account numbers may be suggested as internal identifiers
K	Certificate and license numbers	Medical license, DEA number, driver's license	No type of its own
L	Vehicle identifiers, including license plates	VIN, plate	No type of its own
M	Device identifiers and serial numbers	Implant or monitor serial number, device ID	No type of its own
N	Web addresses (URLs)	Link, website, portal link	Recognizes web addresses
O	IP addresses	IP, client IP	Recognizes IP addresses
P	Biometric identifiers, including finger and voice prints	Rarely a spreadsheet column	Not applicable to the cell values it reads
Q	Full-face photographs and comparable images	Links to image files; pictures embedded in a workbook	Does not read images; check for links to them and for pictures in the workbook
R	Any other unique identifying number, characteristic or code	Study ID, case number, nickname, a rare diagnosis in a small clinic	Codes and long numbers may be suggested as internal identifiers; whether a value is "unique" is your judgment

"No type of its own" means that DataAttendant has no built-in detection for that kind of value, so you have to find those columns yourself.

Which items cause the most mistakes?

Dates. The rule removes every element of a date except the year, for dates directly related to the person, such as a birth date, an admission date or a discharge date. A column of visit dates is therefore a column of identifiers. Reducing each date to its year is one way to meet this. If your analysis needs the gaps between dates, the identifier-removal method does not allow them, and expert determination is the other route, so ask your privacy officer.

Ages over 89. Ages over 89, and any date elements that would show such an age, must be grouped into one category of "90 or older". A birth year of 1930 in a file from 2026 is an example of the second kind.

ZIP codes. The rule allows only the first three digits of a ZIP code, and only when the area formed by all ZIP codes with those three digits holds more than 20,000 people according to the current public Census data. For an area with 20,000 people or fewer, the three digits must be changed to 000. Cutting a ZIP code to three digits is not enough by itself, because the 20,000 test depends on the digits.

Free text. Visit notes and comments contain names, dates and phone numbers inside sentences. A column named "Notes" is not on the list, and its contents often are. Remove it, or read it with the list beside you.

Small clinics and rare conditions. The last item on the list covers any other unique identifying characteristic. In a small practice, a rare diagnosis may point to one patient. See why removing names is not enough.

What about the second condition?

Removing the eighteen identifiers is not the end. The method also requires that the organization has no actual knowledge that what remains could be used, alone or in combination with other information, to identify a person. If you know that two rows in the file can be matched to two patients, for example because only one patient has that diagnosis in that clinic, the removal alone does not meet the rule.

Can you keep a code to go back to the patient?

Yes, under conditions. The rule lets a covered entity assign a code to allow the information to be linked back to the person, if the code is "not derived from or related to information about the individual". It must also not be used or disclosed for any other purpose, and the way to link it back must not be disclosed.

A numbered stand-in that is assigned in order of appearance has no relation to the original value. A code calculated from the original value, such as a hash of the medical record number, is derived from it, so the first kind fits the wording more clearly. Which one your case allows is a question for your privacy officer. The list that links stand-ins to patients stays with you and out of the file you share. See replacing real names with consistent stand-ins.

How do you check a file against the list?

How can DataAttendant help?

DataAttendant is a tool that runs in your web browser, on your own computer. You open a CSV or Excel file, and it looks for personal details by the values in a column and by its heading. It suggests a treatment for each, and shows you a preview and a list of what remains before you download the protected copy. You decide every treatment, and you can save your choices as a reusable plan for the next export of the same kind. The table above shows what it looks for and what it does not. It does not decide whether a file meets the rule, and it does not replace the second condition or your privacy officer. Your file is processed in your browser and is not sent to DataAttendant. Whether using it fits your organization's rules is a question for your privacy officer. How DataAttendant works shows the steps.

Sources

45 CFR § 164.514(a), (b) and (c), read on law.cornell.edu on 28 October 2026. It holds the standard for de-identification, the expert determination method and the list of eighteen identifiers with their ZIP code, date and age conditions. It also holds the condition of actual knowledge and the rule on codes that allow the information to be linked back to a person.
Which organizations are covered entities is set out elsewhere in the regulations and is not covered here.