HIPAA De-Identification Standard (45 CFR 164.514(a)-(b))
Two methods for de-identifying PHI so that it is no longer subject to the Privacy Rule: the Safe Harbor method removing 18 identifier categories, and the Expert Determination method.
Primary source
45 CFR 164.514(a)-(b) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.514(a)-(b) provides two methods to de-identify PHI; once de-identified, the data is no longer PHI and the Privacy Rule does not restrict its use or disclosure.
Safe Harbor (164.514(b)(2)): remove 18 categories of identifiers — name, geographic subdivisions smaller than a state (with limited 3-digit ZIP carve-outs for ZIPs over 20,000 population), all elements of dates except year for dates directly related to the individual, telephone, fax, email, SSN, MRN, plan beneficiary number, account number, certificate/license number, vehicle identifier, device identifier, URL, IP address, biometric identifier, full-face photograph, and any other unique identifier. The covered entity must also have no actual knowledge that the residual data could re-identify the individual.
Expert Determination (164.514(b)(1)): a qualified statistician or domain expert documents a determination that the risk of re-identification is very small and the methods used to support that determination.
OCR's de-identification guidance walks small practices through both methods. Limited data sets per 164.514(e) sit between de-identified and full PHI and are still subject to HIPAA via a data use agreement.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Limited Data Set (45 CFR 164.514(e))A limited data set excludes most direct identifiers but retains dates and geographic data; disclosure requires a written data use agreement.
- RegulationHIPAA Research Uses and Disclosures (45 CFR 164.512(i))Research uses of PHI without individual authorization require either IRB or Privacy Board waiver, a limited data set with data use agreement, or reviews preparatory to research and decedent research with specific safeguards.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Fundraising Restrictions (45 CFR 164.514(f))Covered entities may use limited PHI categories for their own fundraising but must include a clear opt-out mechanism in each communication and honor opt-outs going forward.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.