HIPAA De-identification: Safe Harbor vs Expert Determination (2026)

Last updated: August 2026

What HIPAA De-identification Means

Under HIPAA, health data that has been properly de-identified is no longer PHI and falls outside the Privacy Rule — it can be used and shared much more freely. The catch is doing it correctly. The regulation defines two, and only two, valid methods.

Method 1 — Safe Harbor

Safe Harbor is a checklist: remove 18 specific identifiers and the data is considered de-identified. They include names, all geographic subdivisions smaller than a state, all dates (except year) tied to an individual, phone/fax numbers, email, SSN, medical record numbers, account numbers, biometric identifiers, full-face photos, and any other unique identifying number or code.

Limitation: Safe Harbor is blunt — it can over-remove useful data, and stripping the 18 identifiers does not always eliminate re-identification risk from combinations of remaining fields.

Method 2 — Expert Determination

Expert Determination is statistical: a person with appropriate knowledge and experience applies accepted methods to certify that the risk of re-identification is "very small," and documents the analysis. This is where k-anonymity and quasi-identifiers come in — the expert has to account for fields like ZIP, birthdate, and gender that can single someone out in combination.

Safe Harbor vs Expert Determination

✨ Pseudonymization and De-identification

De-identification and pseudonymization are related but distinct: de-identification aims to make data non-PHI, while pseudonymization keeps data realistic and reversible for testing and AI. Both start with the same hard step — finding every identifier and quasi-identifier across records, documents, and images. That is exactly what Strac’s detection engine does, and it can then suppress, generalize, or redact PHI consistently across every format.

🌶️ Spicy FAQs for HIPAA De-identification

Is masking the same as HIPAA de-identification?

Not automatically. Masking a name helps, but Safe Harbor requires removing all 18 identifiers, and Expert Determination requires a certified risk analysis. Masking is a tool used within de-identification, not a substitute for the method.

Can de-identified data ever be re-identified?

It can, if quasi-identifiers are ignored. That is why Expert Determination explicitly accounts for them — combinations like ZIP + birthdate + gender have famously re-identified individuals.