HIPAA de-identification: Safe Harbor vs Expert Determination

HIPAA recognises two methods for de-identifying protected health information. Safe Harbor removes a specified list of identifiers and requires that you have no actual knowledge the remainder could identify someone. Expert Determination relies on a qualified expert who applies statistical or scientific methods and documents that the risk of identification is very small.

This is general information about US law and not legal advice. HIPAA's application depends on who you are and what data you hold, and a compliance conclusion needs facts that an article cannot see, so speak to a qualified healthcare privacy lawyer before acting on any of it.

Does HIPAA even apply to your data?

HIPAA applies to covered entities, such as many healthcare providers, health plans and clearinghouses, and to their business associates. If you are neither, HIPAA may not govern your data, though other laws might.

This is the first question, and it is often skipped. A company that sells software to clinics, for example, may be a business associate for some data and not for other data, depending on its role and contracts. A wellness app or a health-related business that is not a covered entity may fall outside HIPAA while still being subject to consumer protection and state health-privacy laws.

HIPAA concerns protected health information, meaning individually identifiable health information held or transmitted by a covered entity or business associate. Once information is properly de-identified under the HIPAA standard, it is no longer treated as protected health information under that rule. That is why de-identification matters to anyone thinking about selling healthcare operations data, and why the method has to be done properly.

What are the two methods in plain terms?

HIPAA's de-identification standard offers two routes. One is a rule-based method (Safe Harbor) and the other is a risk-based method (Expert Determination).

Safe Harbor is a recipe: remove the listed identifiers and confirm you have no actual knowledge that what is left could be used to identify the individual. Expert Determination is an analysis: a person with appropriate knowledge and experience of statistical and scientific principles examines the data and the context, concludes that the risk of identification by an anticipated recipient is very small, and documents the methods and results.

Neither route is a certificate that makes data risk-free for all time, and neither replaces sensible contracts. Both are legal standards under which data may be treated as de-identified if the conditions are met.

How does Safe Harbor work?

Safe Harbor requires removal of a defined list of identifiers relating to the individual and to relatives, employers and household members, plus no actual knowledge that the remaining information could identify a person. The list is long and specific, so use the regulation itself and not a summary.

The identifiers include the obvious ones, such as names, contact details, and government and account numbers, and also less obvious categories. Examples that catch people out:

• Dates directly related to an individual, other than the year, such as admission, discharge, birth and service dates.
• Geographic detail smaller than a state, with a limited allowance for part of a postal code where the area is large enough.
• Ages above a threshold, which must be grouped into a single category.
• Device identifiers, web addresses, IP addresses and biometric identifiers.
• Full-face photographs and comparable images.
• Any other unique identifying number, characteristic or code.

The practical difficulty is that the rule applies to everything in the data, including free text. A clinical note or a support message can contain a name or date in an unexpected place, so Safe Harbor on unstructured data requires careful scanning and quality control. Removing dates also removes timing detail, which may make the data less useful for some purposes, such as sequence modelling or time-to-event analysis.

How does Expert Determination work?

Under Expert Determination, a qualified expert assesses the data and concludes that the risk someone could identify an individual is very small, then documents the methods and the result. It allows you to keep more detail than Safe Harbor if the expert is satisfied.

The expert looks at the data, the context in which it will be shared and who is likely to receive it. A key feature is that the conclusion is tied to those circumstances. Sharing the same data with a different recipient, adding other data or releasing it publicly can change the analysis, so determinations often come with conditions, such as limits on linkage, onward sharing and re-identification attempts.

The regulation does not prescribe a single technique or a numeric threshold, and the standard of "very small" is a professional judgement. That flexibility is the strength of the method and also the reason it needs a genuinely qualified person, a documented method and a record you can show if challenged.

Which method should you choose?

Choose Safe Harbor when your data is structured, the fields are well understood and losing some precision is acceptable. Choose Expert Determination when you need to retain detail that Safe Harbor would remove, or when the data is complex.

The two compared:

• Certainty: Safe Harbor is a checklist, so the outcome is easier to predict; Expert Determination depends on the expert's analysis.
• Cost and time: Safe Harbor is usually cheaper in direct cost; Expert Determination involves an expert, though it can pay off on high-value data.
• Data utility: Safe Harbor strips dates and fine geography, which can reduce value; Expert Determination may preserve more.
• Free text and images: both are hard; Safe Harbor needs thorough removal, and an expert will need to assess any residual risk in unstructured content.
• Recipient context: Safe Harbor does not depend on the recipient apart from the knowledge condition; Expert Determination does.

Some organisations use Safe Harbor for routine datasets and Expert Determination for the rare high-value ones. There is no rule that says you must pick one for everything.

What goes wrong in practice?

The common failures are missed identifiers in free text, assuming a partial scrub is enough, and treating a determination as permanent. Most of these are process problems, not legal ones.

Pitfalls to watch for:

• Dates left in notes, filenames or metadata after structured fields are cleaned.
• Rare conditions, small clinics or unusual events that make a record recognisable even without a name.
• Combining a de-identified dataset with another dataset the recipient holds, which can re-create identifiability.
• Relying on a vendor's assurance without seeing the method or the evidence.
• Forgetting that a code used to re-link records, if kept, must itself be handled with care.

Be especially cautious with "limited data sets", which HIPAA treats as a separate concept: they remove some direct identifiers but are still protected health information and can be shared only under specific conditions. They are not de-identified data.

What should a buyer ask a health data seller?

Ask which method was used, who performed it and when, and whether the conclusion depends on conditions the buyer must follow. A seller who cannot answer these questions has not given you the assurance you need.

Buyers should also ask whether the data was ever linked to other datasets and whether any re-linking key still exists. Ask to see the documentation of an expert determination, or the process notes for a Safe Harbor review, under an NDA if necessary. If the seller refuses to share any evidence of how the data was prepared, treat that as a signal to walk away.

How does this fit into selling data?

De-identification under HIPAA is a necessary step for some healthcare data, but it is not the whole analysis. Contract rights, state laws and the buyer's likely use also matter.

If you are thinking about monetising operational records from a healthcare setting, work out first whether HIPAA applies, then whether you have the contractual right to use the data for this purpose, then how to prepare it. That sequence is covered more broadly in monetizing healthcare operations data, and the general techniques in how to de-identify company data before selling it.

The GDPR uses different concepts. A dataset that satisfies a HIPAA method is not automatically anonymous under the GDPR, so if the data involves people in Europe, read anonymization vs pseudonymization as well. Your contract should say what standard the data meets, what was done and what the buyer may not do, such as attempt re-identification.

A checklist before you rely on either method

Work through this list, and record the answers.

1. Confirm whether you are a covered entity or a business associate for this data, and what your contracts allow.
2. Identify every place identifiers could sit: structured fields, free text, attachments, logs and metadata.
3. Choose the method and who will carry it out, with a qualified expert if using Expert Determination.
4. Apply the method and test the output through sampling and independent review.
5. Document the method, the decisions, the date and who approved them.
6. Set contract limits on re-identification, linkage and onward transfer.
7. Schedule a review if the data, the recipient or the available outside data changes.

Keep the record somewhere your team can find it, because buyers, auditors and your own successors will ask for it later. If any answer is uncertain, pause. For health data, the cost of a mistake falls on real people as well as on you, and a listing can wait.

Frequently asked questions

What is the difference between Safe Harbor and Expert Determination?

Safe Harbor removes a defined list of identifiers and requires no actual knowledge that the rest could identify a person. Expert Determination uses a qualified expert to conclude that the risk of identification is very small, and to document the method. One is rule-based, the other is risk-based.

Is HIPAA de-identified data completely safe to share?

No method makes data risk-free. De-identified data under HIPAA is treated as outside the protected health information rules if the standard is met, but re-identification risk can change with context, linked data and time. Contracts and security controls still matter, and other laws may apply.

Can free-text clinical notes be de-identified?

They can be, but it is difficult. Notes can contain names, dates and other identifiers in unpredictable places, and automated tools miss some. Safe Harbor requires removal of all listed identifiers, and an expert will need to assess residual risk in unstructured text. Many organisations decide the effort is not worthwhile for notes.

Does HIPAA apply to every company that holds health information?

No. HIPAA applies to covered entities and their business associates. Other businesses that hold health-related data may not be covered, although other federal and state laws can still apply. Work out your status before assuming either that HIPAA applies or that it does not.

Who should perform an Expert Determination?

A person with appropriate knowledge of and experience with statistical and scientific principles for rendering information not individually identifiable. The regulation does not prescribe credentials, so check experience, ask for the method and keep the documentation. A healthcare privacy lawyer can help you choose and review the work.