HIPAA Safe Harbor and the 18 Identifiers

What is HIPAA Safe Harbor?

HIPAA Safe Harbor is a de-identification method defined in the HIPAA Privacy Rule at 45 CFR 164.514(b)(2). It is one of two ways a US healthcare organization can turn protected health information (PHI) into data that is no longer regulated by HIPAA.

Under Safe Harbor, you remove 18 categories of identifiers from a record. You must also have no actual knowledge that the remaining data could be used, alone or combined with other data, to identify the person. Once both conditions are met, the data is considered de-identified and can be used or shared without HIPAA restrictions.

The other method is Expert Determination, where a qualified statistician certifies that the risk of re-identification is very small. Safe Harbor is the more mechanical, checklist-style option, which makes it easier to automate but stricter about what must come out.

What are the 18 HIPAA Safe Harbor identifiers?

The 18 identifiers are listed directly in the Privacy Rule. They cover direct identifiers like names, and indirect ones like dates and geographic detail that can single a person out when combined.

• —Names
• —Geographic data smaller than a state (street, city, county, ZIP in most cases)
• —All dates tied to an individual except year (birth, admission, discharge, death)
• —Ages over 89 and dates indicating such age
• —Telephone numbers
• —Fax numbers
• —Email addresses
• —Social Security numbers
• —Medical record numbers
• —Health plan beneficiary numbers
• —Account numbers
• —Certificate or license numbers
• —Vehicle identifiers and license plate numbers
• —Device identifiers and serial numbers
• —Web URLs
• —IP addresses
• —Biometric identifiers, including finger and voice prints
• —Full-face photos and comparable images, plus any other unique identifying number, characteristic, or code

Safe Harbor vs Expert Determination

Both methods produce de-identified data under HIPAA, but they trade effort for flexibility in different ways.

Common confusions about Safe Harbor

De-identification is not the same as redaction. Redaction hides values in a document. Safe Harbor de-identification is a legal standard that requires removing all 18 identifier types and confirming low re-identification risk.

Safe Harbor is also not pseudonymization. Pseudonymization swaps an identifier for a token while keeping a way to reverse it. Under Safe Harbor you cannot keep a key that maps back to the person, and any code you assign cannot be derived from the actual identifier.

A frequent mistake is keeping full dates or ZIP codes. Only the year is allowed for dates, and ZIP codes must be truncated to the first three digits (and zeroed out for sparsely populated areas). Leaving day and month in place, or full ZIPs, breaks Safe Harbor.

How Sanitext relates to Safe Harbor

Sanitext detects and redacts personal identifiers in free text. It finds names, emails, phone numbers, addresses, dates, URLs, account and card numbers, and secrets in 30+ languages, and can mask each span as a label like [EMAIL] or [DATE].

That covers most of the text-based identifiers in the Safe Harbor list and helps you minimize PHI before it reaches a log, a prompt, or a third party. But Sanitext is a redaction aid, not an anonymization or compliance guarantee. It does not certify de-identification, handle structured fields or images, or replace legal review.

Treat it as one layer in a Safe Harbor or PHI de-identification workflow. You still own the final check for the 18 identifiers and the no-actual-knowledge requirement.

FAQ