What the Safe Harbor method says you must remove, where each identifier hides in real documents, and the rules people get wrong.
The HIPAA Privacy Rule's Safe Harbor method lists 18 types of identifiers that must be removed from health information before it counts as de-identified. They are the identifiers of the individual and also of the individual's relatives, employers and household members. Removing them is only half the test: the organization must also have no actual knowledge that what remains could be used, alone or in combination with other information, to identify the person [1].
The 18 types are: names; geographic subdivisions smaller than a state; dates (except year) and ages over 89; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers and serial numbers; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers; full-face photographs and comparable images; and any other unique identifying number, characteristic or code.
| # | Identifier (45 CFR 164.514(b)(2)) | Where it shows up in documents |
|---|---|---|
| 1 | Names | Patient name in headers and footers, "Dear Ms. ..." salutations, signature blocks, and names of relatives or employers mentioned in the narrative |
| 2 | Geographic subdivisions smaller than a State, including street address, city, county, precinct, ZIP code and equivalent geocodes | Address blocks, hospital or clinic locations tied to the patient, "lives in [town]" in clinical notes |
| 3 | All elements of dates (except year) directly related to the individual, including birth, admission, discharge and death dates; ages over 89 | Date of birth, admission and discharge dates, appointment dates, lab collection dates, "died on ..." |
| 4 | Telephone numbers | Contact details, emergency contacts, fax cover sheets |
| 5 | Fax numbers | Referral and records-request cover pages |
| 6 | Email addresses | Patient portal messages, referral emails, correspondence |
| 7 | Social Security numbers | Registration forms, insurance paperwork, billing records |
| 8 | Medical record numbers | Repeated on every page header, lab reports, discharge summaries |
| 9 | Health plan beneficiary numbers | Insurance cards, claims, prior authorization forms |
| 10 | Account numbers | Billing statements, payment records |
| 11 | Certificate and license numbers | Driver's license or professional license numbers on intake forms |
| 12 | Vehicle identifiers and serial numbers, including license plates | Accident and injury reports, transport records |
| 13 | Device identifiers and serial numbers | Implant records, pacemaker or pump logs, device cards |
| 14 | Web URLs | Portal links, links in referral letters and printouts |
| 15 | IP addresses | Portal access logs, email headers, telehealth records |
| 16 | Biometric identifiers, including finger and voice prints | Biometric enrollment records, voice recordings |
| 17 | Full-face photographic images and comparable images | Photos in charts, ID badges, wound or dermatology images |
| 18 | Any other unique identifying number, characteristic or code | Case IDs, study subject numbers, unique descriptions, internal codes |
Safe Harbor does not let you keep a ZIP code, but it does allow the first three digits in one case. The first three digits may stay only if, according to current publicly available Census data, the area formed by combining all ZIP codes with those same first three digits contains more than 20,000 people. For areas with 20,000 people or fewer, those three digits must be changed to 000 [1]. So "keep the first three digits" is not a blanket rule. The same item also covers anything smaller than a state, including street address, city, county and precinct.
All elements of dates except the year must go, for dates directly related to the individual. That includes birth date, admission date, discharge date and date of death. "March 2024" is not allowed; "2024" is. Ages over 89, and all date elements that would indicate such an age, must be aggregated into a single category of "90 or older" [1].
The last item is deliberately broad. The word "characteristic" means a description can count as well as a number. There is one exception: a covered entity may assign its own code that allows it to re-identify the record later, as long as the code is not derived from or related to information about the individual, cannot be translated to identify the person, and is not used or disclosed for any other purpose, nor is the mechanism for re-identification disclosed [1].
Diagnoses, medications, lab values and treatment details are not among the 18 types. That is why a de-identified record can stay clinically useful. But the "actual knowledge" condition still applies: a distinctive detail in the narrative can point to one person even when every listed identifier has been removed.
Safe Harbor is one of two HIPAA methods. The other, Expert Determination, relies on a person with appropriate statistical and scientific expertise who determines that the risk of identification is very small and documents the analysis [1]. For a wider comparison of the methods and the terms around them, read our guide to document de-identification.
Re-Doc finds identifiers in the text of native PDF, DOCX and TXT files and replaces them with consistent synthetic values, keeping the layout, so a record stays readable. Scanned pages are redacted with black boxes. Your privacy team decides how each category should be treated and signs off the result. For identifiers in images, such as full-face photographs, or for custom requirements, contact our team to discuss options.
Whichever tool you use, check it on a sample of your own documents and count what it missed, especially in headers, footers and free text. You can try Re-Doc on your own files, with the first 10 pages free, at re-doc.com/try. For healthcare workflows, see our healthcare page.
They are names; geographic subdivisions smaller than a state; dates except year, and ages over 89; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers and serial numbers; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers; full-face photographs and comparable images; and any other unique identifying number, characteristic or code. They are listed in 45 CFR 164.514(b)(2) [1].
Yes. All elements of dates except the year are covered when they relate directly to the individual, so a full date of birth must be removed. The birth year alone may remain, except that ages over 89 and the dates that indicate them must be grouped as "90 or older" [1].
Only the first three digits, and only when the area covered by those three digits has more than 20,000 people. For smaller areas the three digits must be changed to 000 [1].
Yes. The rule lists the identifiers of the individual and of the individual's relatives, employers and household members [1].
No. Safe Harbor also requires that the organization has no actual knowledge that the remaining information could identify the person, alone or in combination with other information. Expert Determination is the alternative route [1][2].
No. Clinical details are not on the list, but a distinctive detail can still identify someone in combination with other information, which is why the actual knowledge condition matters.
HIPAA is a US law that applies to covered entities and their business associates. Other regimes use different tests. The EU GDPR, for example, treats data as anonymous only if people cannot be identified by any means reasonably likely to be used (Recital 26) [3]. See our guide to redaction vs anonymization vs pseudonymization.
Reviewed by the Re-Doc team. Last reviewed 1 October 2026. This article is general information, not legal advice. Check the current text of the regulation, and your own obligations, with your privacy or legal counsel.
