Two HIPAA Paths: Regulation First Data De-Identification Methods for Researchers

The two HIPAA-accepted paths to de-identified data are Safe Harbor and Expert Determination, and most datasets benefit from combining one of them with technical controls like suppression, generalization, perturbation, pseudonymization, and differential privacy. HHS and NIST both frame de-identification as a process, not a one-time scrub. Rule-based methods like Safe Harbor suit low-stakes, fast-turnaround releases; Expert Determination fits high-utility research datasets where analytic detail matters, and partners like Kohealth Labs build both into standard data delivery.

TL;DR:

• Safe Harbor achieves de-identification by removing 18 specific identifiers, but it can significantly reduce data utility for longitudinal and granular geographic analyses.
• Expert Determination involves a qualified expert assessing and documenting a low re-identification risk, allowing for more detailed data retention but requiring higher upfront costs.
• Technical methods like suppression, generalization, perturbation, pseudonymization, and statistical models vary in their privacy-utility trade-offs and must be chosen based on dataset size, research needs, and risk level.
• Unstructured data such as free-text notes and burned-in images require specialized redaction tools and manual review to prevent identifier leakage.
• Ongoing risk management, including periodic re-evaluation and governance through disclosure review boards, is critical for maintaining privacy protections over time amid evolving external data sources.

What Are Data De-Identification Methods Under HIPAA?

HIPAA gives covered entities exactly two accepted routes to strip identifying information from Protected Health Information, and the choice between them shapes everything downstream: cost, timeline, and how much scientific value survives the process.

Safe Harbor works like a checklist. You remove 18 specific categories of identifiers, and the data is legally de-identified. No statistical analysis required, no outside expert needed. The HHS guidance lists the identifiers explicitly, and they go well beyond names and Social Security numbers:

• Names, geographic subdivisions smaller than a state, and all elements of dates (except year) directly tied to an individual, including birth date and admission date
• Telephone numbers, fax numbers, email addresses, and medical record numbers
• Device identifiers, serial numbers, and vehicle identification numbers
• Full-face photographic images and any comparable images
• Biometric identifiers, including finger and voice prints

If you have ever tried to run a longitudinal analysis after stripping every date down to a bare year, you already know Safe Harbor's weakness. Age above 89 must also be aggregated into a single category, which erases meaningful variation in a population where geriatric outcomes often hinge on the difference between 90 and 99.

Expert Determination takes a different route. A person with appropriate statistical and scientific knowledge applies accepted methods to determine that re-identification risk is "very small," then documents the analysis, methods used, and the reasoning behind the conclusion. The HHS guidance does not fix a numeric threshold for "very small." That is a deliberate design choice. Risk is contextual: who receives the data, what other datasets they can plausibly access, and how the data will be used all factor into the expert's judgment.

Quick Fact: HIPAA recognizes only two de-identification methods, Safe Harbor and Expert Determination, and both require the covered entity to reasonably believe the information alone cannot identify an individual once the process is complete.

Expert Determination costs more upfront. You need a qualified professional, a documented methodology, and often a re-evaluation cycle. But it pays off in data utility. An expert can often retain month-level dates, finer geography, or more granular age bands than Safe Harbor allows, because the risk calculation accounts for those specifics rather than banning them outright. For a clinical trial dataset going to a small group of vetted researchers under a data use agreement, Expert Determination usually preserves far more analytic signal than the Safe Harbor checklist ever could.

Practically speaking, Safe Harbor tends to suit fast, low-friction releases, public-facing datasets, or teams without ready access to a qualified statistician. Expert Determination tends to suit machine learning training sets, longitudinal cohort studies, and any project where the loss of date precision or geographic detail would meaningfully degrade the research question. Many organizations use Safe Harbor as a default and reserve Expert Determination for the datasets where utility genuinely matters.

Core Methods for Structured and Tabular Data

Structured data, the rows and columns of an EMR export or a lab results table, is where de-identification gets technically interesting. NIST IR 8053 catalogs the standard technical approaches, and each one trades privacy for utility differently.

1. Suppression

Suppression removes a field or an entire record outright. Field-level suppression drops a column, such as an exact street address, that carries too much identifying weight relative to its analytic value. Record-level suppression removes an entire row, usually because it belongs to someone rare enough in the dataset to stand out, like the only patient over 100 in a geriatric cohort. Use suppression when a variable adds little to the analysis but a lot to re-identification risk.

2. Generalization and aggregation

Generalization reduces precision rather than removing data entirely. Ages become five-year bins instead of exact years. ZIP codes get truncated to the first three digits. Exact admission dates become month and year. This preserves more analytic value than suppression because the variable still exists, just at a coarser resolution. The trade-off shows up quickly in small-area analyses: if your research question depends on ZIP-level disease clustering, truncating to three digits may erase the pattern you are trying to study.

3. Perturbation and microaggregation

Perturbation adds controlled statistical noise to values, distorting individual records while preserving population-level statistics like means and variances. Microaggregation groups similar records and replaces individual values with the group average. Both techniques work well when your analysis cares about distributions and trends rather than exact individual values, which describes most epidemiological and health-outcomes research. They work poorly when precision at the individual record level is the whole point, such as validating a specific lab result against a specific timestamp.

4. Pseudonymization and tokenization

Pseudonymization replaces direct identifiers with artificial identifiers, either through a lookup table (a simple key-value mapping stored separately and securely) or a keyed cryptographic transform (a one-way hash or encryption function that requires a secret key to reverse). The distinction matters for security architecture. Lookup tables are simpler to implement but create a single point of failure: if the table leaks, every pseudonym unravels at once. Keyed cryptographic approaches distribute that risk, but only if the key itself is stored separately from the data and rotated on a defined schedule. This is the heart of the pseudonymization vs anonymization distinction that trips up a lot of compliance teams: pseudonymized data is still considered personal information under most frameworks because the mapping to identify someone still exists somewhere, even if it is locked away. Anonymized data, by contrast, has no recoverable link back to an individual at all.

5. Statistical privacy models

This is where de-identification stops being a checklist and becomes a measurement discipline. NIST IR 8053 and NIST SP 800-188 both point practitioners toward a family of models that quantify, rather than assume, disclosure risk:

• K-anonymity ensures every record is indistinguishable from at least k-1 other records based on quasi-identifiers like age, ZIP code, and gender. A k of 5 means any combination of those variables matches at least five people in the dataset.
• L-diversity extends k-anonymity by requiring that each group of indistinguishable records also contains at least l distinct values for a sensitive attribute, like diagnosis. This closes a real gap in k-anonymity, where a group of five people who are all HIV-positive still leaks the diagnosis even though no individual is singled out.
• T-closeness goes further still, requiring the distribution of sensitive attributes within each group to closely match the distribution across the whole dataset, preventing attribute leakage even when diversity exists.
• Differential privacy adds mathematically calibrated noise to query results or aggregate statistics, providing a provable bound on how much any single record can influence the output. It fits large datasets and repeated queries, such as a public health dashboard, better than it fits one-time record-level releases.

Pro Tip: Run k-anonymity checks on your quasi-identifier combinations before you release anything, even if you plan to rely on Expert Determination. Finding a k of 2 on a rare age-and-ZIP combination early saves you from a failed determination later.

A quick checklist for matching dataset traits to methods:

De-Identifying Free Text, Documents, and Medical Images

Unstructured data hides identifiers in places a column-based checklist will never catch. A radiology report's free-text impression field, a clinician's progress note, or the pixel data burned into a scanned document all carry identifying information that structured methods cannot touch.

Free text and clinical notes

Named-entity recognition (NER) tools scan free text for patterns that match names, dates, locations, and other identifier categories, then flag them for redaction or replacement. The technical challenge is confidence thresholds. Set the threshold too aggressively and the tool over-redacts, stripping clinically meaningful terms that merely resemble names (a drug named after its discoverer, for instance). Set it too loosely and identifiers slip through. Most production pipelines pair automated NER with a human review pass on a sample of the output, since no current tool achieves reliable enough accuracy to skip verification entirely on regulated health data.

Redaction and pseudonymization diverge here too. Redaction deletes the identifying text and leaves a placeholder, which is simpler but destroys any ability to track the same patient across multiple notes. Pseudonymization swaps the identifier for a consistent token, preserving the ability to link records for a single patient across a longitudinal chart while still hiding who that patient is.

DICOM and medical imaging

Medical imaging carries two separate identifier problems, and both need solving. DICOM files store patient name, ID, birth date, and institution directly in the header metadata, which any competent imaging pipeline can strip or pseudonymize in a batch process. But many scans also carry burned-in text directly on the pixel data itself, a patient name stamped in the corner of an ultrasound image or an accession number overlaid on a CT slice. Metadata stripping alone misses this entirely.

Quick Fact: Burned-in identifiers on medical images require pixel-level detection and removal, a separate process from DICOM header de-identification, and skipping this step is one of the most common gaps in imaging data pipelines.

Kohealth Labs's own technical walkthrough on DICOM de-identification covers the practical steps for stripping both header metadata and burned-in text while preserving the pixel data researchers actually need for diagnostic analysis. The goal is not to degrade the image, just to remove what identifies the person in it.

Genomic and multimedia data

Genomic sequences and multimedia files (video, audio, high-resolution photography) carry re-identification risk that dwarfs most structured data, because the data itself can be a near-unique fingerprint. A full genomic sequence is, functionally, an identifier. For these categories, de-identification alone rarely satisfies a reasonable risk standard. Controlled access agreements, data enclaves, or stronger differential privacy guarantees tend to be the more defensible route than trying to strip identifiers from the data itself.

Verification matters as much as the redaction

Automated detection metrics (precision and recall against a labeled test set of known identifiers) give you a quantitative sense of how well your pipeline performs. But metrics alone will not catch every failure mode. Pair automated scoring with periodic manual audits on a random sample of processed records, checking specifically for missed burned-in text, residual dates in free-text fields, and NER false negatives on uncommon name formats.

Choosing Your Method: Risk Assessment and Governance

The decision between Safe Harbor and Expert Determination, and the technical methods underneath either path, starts with one question: who is going to receive this data, and what else can they access?

Define the recipient profile first. A dataset going to a single trusted academic collaborator under a signed data use agreement carries a different risk calculus than one destined for open public release. NIST SP 800-188 frames this as identifying anticipated external data sources: what other datasets, public records, or social data could a recipient plausibly combine with yours to re-identify someone.

From there, work through a stepwise risk assessment:

• Identify every quasi-identifier in the dataset, not just direct identifiers. Age, ZIP code, admission date, and rare diagnoses combine to identify people even when no single field does.
• Estimate re-identification risk using a statistical model appropriate to the data (k-anonymity for categorical quasi-identifiers, a re-identification probability estimate for continuous variables).
• Set an acceptable risk threshold before you start transforming data, not after. HHS does not fix this number, but many Expert Determination reports document thresholds in the range organizations have defended successfully before, often informed by the anticipated recipient's own capabilities and intent.

If you commission an Expert Determination, expect the deliverable to include the methods applied, the specific risk figures calculated, the assumptions about recipient capability, and a dated conclusion. That documentation is not paperwork for its own sake. If your data, your recipient pool, or the external data landscape changes, the determination needs re-evaluation. A dataset judged low-risk against 2023's publicly available voter files may not clear the same bar once a new public dataset makes triangulation easier.

Pro Tip: Treat every Expert Determination as a living document with an expiration trigger, not a permanent stamp of approval. Set a calendar reminder tied to major changes in your data pipeline or recipient list, not just an arbitrary annual date.

Governance closes the loop. NIST SP 800-188 recommends establishing a Disclosure Review Board, a standing group that reviews de-identification decisions, maintains audit trails of what was transformed and why, and schedules periodic re-identification testing against the current data landscape. Organizations that skip this step tend to treat de-identification as a one-time technical task rather than the ongoing risk-management process it actually is.

Implementation Patterns, Tools, and Common Pitfalls

Getting the technical methods right on paper is one thing. Running them reliably, at scale, across a research program is another.

1. Choose batch or on-demand extraction deliberately

Batch de-identification, processing entire datasets on a fixed schedule, is easier to operationalize and audit because the transformation logic runs the same way every time. On-demand cohort extraction, pulling and transforming only the records a specific study needs, reduces the volume of de-identified data sitting in storage at any given time, which shrinks your exposure if something goes wrong. The trade-off is complexity: on-demand systems need robust, audited selection logic to avoid inconsistent transformations across requests.

2. Evaluate tools against risk metrics, not just masking

A tool that hides a Social Security number is not the same as a tool that measures disclosure risk. Many masking-only products give a false sense of security because they lack the statistical reporting an Expert Determination actually requires. When evaluating software, check whether it reports k-anonymity or l-diversity values, supports differential privacy parameters, and produces reproducible audit logs you can hand to a reviewer.

3. Watch for these recurring mistakes

• Naive field masking that ignores quasi-identifier combinations, leaving small subgroups re-identifiable even after direct identifiers are gone.
• Derived identifiers slipping through, such as a calculated age-at-visit field that recreates a stripped birth date.
• Rare records and outliers treated the same as the bulk of the dataset, when they often need suppression or extra generalization.
• Assuming one de-identification pass is permanent, rather than scheduling re-testing as external data sources evolve.

4. Build operational controls around the pipeline itself

Logging every transformation, enforcing role-based access control on who can view pre-transformation data, defining clear data retention limits, and applying data minimization at collection (not just at release) all reduce the surface area for something to go wrong long before de-identification even starts.

Kohealth Labs's View on Integrated Diagnostics and Research-Grade De-Identification

Clinical trial data quality problems rarely start at the analysis stage. They start earlier, at the point where lab results, imaging, and clinical metadata get handed off between vendors, each with its own format, its own identifier scheme, and its own idea of what "de-identified" means. Kohealth Labs was built around the idea that integrated diagnostics, including labs, radiology, and data delivery under a single contract, accelerates clinical trials it precisely removes those handoff points.

When lab and imaging pipelines run through one integrated system, AI-driven quality checks can flag deviations and identifier leakage at the source, before data ever reaches a research team. That matters for re-identification risk in a way that siloed vendor relationships cannot easily replicate: a single pipeline can enforce one consistent transformation logic across every biomarker panel and imaging series, rather than trusting each vendor to apply its own inconsistent standard.

Operationally, this shows up in a few concrete practices:

• A provider portal that gives sponsors visibility into data status without exposing raw pre-transformation records
• Documented onboarding and training that establishes governance expectations before the first specimen ever moves
• Audit trails that support the documentation an Expert Determination review will eventually ask for
• Analytics coverage across more than 100 biomarkers, structured from the outset to support both Safe Harbor and Expert Determination workflows

Kohealth Labs's approach to healthcare data integration reflects a broader pattern in clinical research: the fewer vendors touch a dataset before de-identification, the fewer places re-identification risk can quietly accumulate.

Data Utility vs. Re-Identification Risk: Making the Trade-Off

Every de-identification decision is a trade-off, and pretending otherwise leads to bad outcomes on both sides. Push too hard toward privacy protection and you generalize away the exact variables your research question depends on. Push too hard toward utility and you risk a re-identification finding that undoes months of work.

The comparison between Safe Harbor and Expert Determination captures this cleanly: Safe Harbor is fast and repeatable but caps utility at whatever the 18-identifier checklist allows, regardless of your actual recipient's risk profile. Expert Determination lets the risk assessment match the real-world context, often preserving month-level dates or finer geography, but it costs more in expertise and documentation time.

The practical rule of thumb: match the method to the analytic stakes, not to habit. A dataset feeding a machine learning model that needs temporal patterns justifies the cost of Expert Determination. A one-off aggregate report for a grant application probably does not. Ask what precision the analysis genuinely requires before choosing a method, then work backward to the technical transformations that preserve exactly that much detail and no more.

Beyond HIPAA: GDPR, CCPA, and Other Regulatory Layers

HIPAA governs Protected Health Information in the United States, but plenty of research data crosses into other frameworks. The European Union's GDPR treats "anonymized" data (irreversibly stripped of any link to an individual) as entirely outside its scope, while "pseudonymized" data remains personal data subject to the full regulation, since the mapping back to an individual still technically exists. That distinction is sharper than HIPAA's own framework and trips up teams who assume Safe Harbor's identifier removal counts as GDPR anonymization. It usually does not, because a truly irreversible anonymization standard under GDPR is stricter than HIPAA's Safe Harbor list.

The California Consumer Privacy Act (CCPA) takes a different angle again, defining de-identified information as data that cannot reasonably be linked to a consumer, provided the business implements technical safeguards and makes a public commitment not to re-identify it. That public commitment requirement has no direct HIPAA equivalent.

For any research program spanning multiple jurisdictions, or any dataset that might eventually cross borders, the safest approach applies the strictest applicable standard rather than assuming HIPAA compliance satisfies every regulator a dataset might encounter.

Industry Standards: How Healthcare and Finance Differ

Healthcare and finance both handle sensitive personal data, but their de-identification norms diverge in ways worth knowing before you borrow a method from the wrong industry.

Healthcare research leans on the HIPAA framework described throughout this guide, with NIST SP 800-188 supplying the technical governance layer HIPAA itself does not specify. Clinical trial data adds another wrinkle: sponsors often need to retain re-identification capability for adverse event follow-up, which means true anonymization is rarely the goal. Pseudonymization with tightly controlled key management fits clinical research better than irreversible anonymization in most cases.

Financial services data de-identification tends to focus more heavily on tokenization of account numbers and transaction identifiers, often under PCI DSS requirements for payment data rather than a HIPAA-style identifier checklist. The statistical risk models NIST describes still apply, but the regulatory anchor and the specific fields at risk (account numbers and routing numbers rather than dates of birth and ZIP codes) differ enough that a healthcare de-identification playbook needs real adaptation before it works for financial data.

How AI and Machine Learning Are Changing De-Identification

Machine learning cuts both ways in the de-identification field, functioning as both the tool and the threat.

On the tooling side, NER models have made free-text redaction dramatically more scalable than manual chart review ever was, and modern models handle a wider variety of name formats, abbreviations, and clinical shorthand than earlier rule-based systems. AI-driven quality checks can also flag inconsistent transformations across a large dataset faster than a manual audit, catching a missed identifier in record 40,000 that a human reviewer would likely miss.

On the risk side, machine learning is exactly what makes re-identification easier than it used to be. Models trained to link records across datasets, sometimes called linkage models, can match "de-identified" records to public records with a fraction of the quasi-identifiers a human analyst would need. That is precisely why NIST IR 8053 frames re-identification as an evolving threat rather than a fixed risk you calculate once. Any de-identification program that ignores the pace at which linkage tools improve is measuring risk against yesterday's threat model.

De-Identifying Longitudinal and Time-Series Data

Longitudinal datasets, where the same patient appears across multiple visits over months or years, carry a re-identification risk that single-snapshot data does not: the sequence of events itself can be an identifying fingerprint, even after individual fields are transformed.

Date-shifting is the standard technique. Instead of removing dates entirely (which destroys the ability to study intervals between events), shift every date for a given patient by the same random offset. This preserves the relative timing between visits, lab draws, or medication changes, which is often exactly what longitudinal research needs, while removing the absolute calendar date that could link a record to a real-world event.

Consistent pseudonym mapping across the full time series matters just as much. If a patient's identifier changes between visit one and visit two, you lose the ability to study their trajectory at all. The pseudonym must stay stable across every record tied to that patient while remaining disconnected from their real identity, which is exactly the lookup-table or keyed-token approach described earlier in the structured-data methods.

Watch for indirect re-identification through visit patterns themselves. A patient with a distinctive sequence of rare procedures across five visits can be identifiable from that sequence alone, even with every date shifted and every name removed, if the pattern is rare enough in the broader population.

Linkage Attacks and Data Triangulation Risk

A linkage attack works by combining a de-identified dataset with one or more outside datasets to re-identify individuals, and it is the single most realistic threat model for any research dataset released beyond a tightly controlled group.

The classic example: a dataset with birth date, ZIP code, and gender, stripped of name and address, still uniquely identifies a large share of a general population when cross-referenced against public voter registration records. This is exactly why quasi-identifiers matter as much as direct identifiers in any serious risk assessment. Triangulation compounds the problem: an attacker combining three or four partial datasets, each individually harmless, can sometimes reconstruct enough of a profile to re-identify someone that no single dataset could expose alone.

Defending against linkage attacks means assessing risk against realistic, anticipated data sources rather than an abstract worst case. A dataset headed to a single academic partner under a signed agreement faces a different linkage landscape than one released as open data. This is also the strongest argument for periodic re-identification testing rather than a one-time risk assessment: the pool of publicly available datasets an attacker could use for triangulation only grows over time, and a determination that held up in 2024 may not hold up against 2026's data landscape.

Practitioner's Checklist: Preparing a Dataset for Release

Use this sequence before any dataset leaves your organization, whether it is headed for public release, a restricted research partner, or an Expert Determination review.

1. Inventory every direct identifier and quasi-identifier in the dataset, field by field.
2. Choose your approach: Safe Harbor for speed, Expert Determination for utility, or controlled access if the data is genomic, multimedia, or otherwise too identifying to de-identify responsibly.
3. Apply transformations: suppression, generalization, date-shifting, pseudonymization, and statistical noise as appropriate to each field.
4. Run risk tests: calculate k-anonymity or an equivalent metric against your chosen threshold before release.
5. Document every decision in a transformation record: what changed, why, and under what assumption about the recipient.
6. Sign off through your Disclosure Review Board or equivalent governance step, with a re-evaluation date attached.

Keep three documents on file for every release: a risk log tracking the quasi-identifiers assessed and the resulting risk figure, a transformation record listing every field-level change applied, and, where relevant, a full Expert Determination report covering methods, assumptions, and conclusions. When the data is genomic, high-resolution multimedia, or otherwise carries identifying signal that resists transformation, controlled access, not de-identification, is the safer call.

How Kohealth Labs Supports De-Identification for Clinical Research

Building an in-house de-identification pipeline across multiple lab vendors, imaging providers, and data formats takes months most trial timelines cannot spare. An alternative to juggling separate vendor contracts for labs, radiology, and data delivery is a unified contract, a single data pipeline, and AI-driven quality checks applied consistently across biomarker panels and imaging series before data reaches the research team.

That consistency matters directly for de-identification governance. When labs and radiology run through separate vendors, each with its own export format and its own identifier-handling practices, your Disclosure Review Board ends up reconciling several different transformation standards instead of auditing one. Kohealth Labs's integrated diagnostics and analytics platform applies AI-driven quality checks across more than 100 biomarkers and imaging series under a single governance framework, which shortens the audit trail sponsors and CROs need for Expert Determination review.

Sponsors and CROs running multi-site trials, or programs with tight timelines for interim analyses, tend to benefit most from an integrated partner over a stitched-together in-house pipeline. If your team manages phlebotomy, imaging, and EMR integration across several vendors today, explore Kohealth Labs's integrated diagnostics services for CROs and pharma sponsors or review the pathology laboratory services page to see how a single-contract model handles specimen pickup, provider portal access, and analysis-ready data delivery together.

Primary Sources Worth Reading Directly

Every method described in this guide traces back to a small set of primary sources, and reading them directly beats relying on secondhand summaries once you are actually implementing a program.

• HHS HIPAA De-Identification Guidance: the definitive policy source for Safe Harbor and Expert Determination requirements under the Privacy Rule.
• NIST SP 800-188: the governance framework for treating de-identification as a lifecycle, including Disclosure Review Boards and re-identification testing.
• NIST IR 8053: the technical reference for suppression, generalization, perturbation, and statistical disclosure control methods.
• Johns Hopkins Library's De-Identification Steps Guide: a practical, stepwise walkthrough useful for building an internal checklist.
• Censinet's Safe Harbor vs. Expert Determination comparison: a clear, practitioner-oriented breakdown of the trade-offs between the two HIPAA paths.

The Gap Between De-Identification Theory and Practice

Most guidance on de-identification treats it as a technical exercise: apply the right algorithm, hit the right k-anonymity threshold, ship the data. That framing misses what actually causes failures in practice. The datasets that get re-identified are rarely the ones where the math was wrong. They are the ones where the risk assessment never accounted for how the data landscape would change after release.

A determination made in 2023 assumed a certain set of public datasets existed for triangulation. By 2026, new public records, new commercial data brokers, and better linkage models have all expanded what an attacker could combine with your "de-identified" release. NIST's framing of de-identification as a governance lifecycle, not a one-time transform, is the part of the guidance most teams skip, and it is exactly the part that prevents the failures that make headlines.

Here is the contrarian point worth sitting with: teams that over-invest in the technical transformation and under-invest in re-evaluation are optimizing for the wrong risk. A dataset with slightly weaker k-anonymity but a documented, funded process for periodic re-testing is safer over a five-year research program than a dataset with a perfect initial risk score and no plan to ever look at it again. Compliance officers who treat Expert Determination as a stamp to obtain once, rather than a commitment to revisit, are setting up their organization for a re-identification finding that arrives right when a trial's data is most valuable and hardest to walk back.

The organizations that get this right tend to be the ones that built re-evaluation into their contracts and pipelines from the start, not the ones that scrambled to add it after a near-miss. That is as true for an in-house research team as it is for any integrated diagnostics partner handling the work at scale.

— Kohealth Labs

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

Sources

• Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule
• NIST SP 800-188
• De-Identification of Personal Information — NIST IR 8053
• HIPAA Safe Harbor vs. Expert Determination | Censinet
• Steps for De-Identifying Data - Protecting Human Subject Identifiers | Johns Hopkins

FAQ

What are some examples of de-identified data?

Common examples include a clinical trial dataset with dates shifted and ZIP codes truncated to three digits, a research dataset with names replaced by consistent pseudonyms, and aggregate public health statistics released under differential privacy guarantees. Each example still carries analytic value while meeting a documented re-identification risk standard.

How many acceptable methods are there for de-identification under HIPAA?

HIPAA recognizes exactly two accepted methods: Safe Harbor, which requires removing 18 specific identifier categories, and Expert Determination, where a qualified expert documents that re-identification risk is very small.

What is another way to say "de-identified"?

"Anonymized" is often used interchangeably in casual conversation, though the terms differ under some frameworks like GDPR. "Privacy-protected" and "coded" also appear in research contexts, though "coded" more precisely describes pseudonymized data where a re-identification key still exists.

Does HIPAA apply to de-identified data?

No. Once data meets the Safe Harbor or Expert Determination standard, HIPAA's Privacy Rule no longer restricts its use or disclosure, because it is no longer considered Protected Health Information.

What is the difference between pseudonymization and anonymization?

Pseudonymization replaces identifiers with tokens while keeping a mapping key that could reverse the process, so the data remains personal information under most regulatory frameworks. Anonymization removes that link entirely and irreversibly, which is a higher bar than HIPAA's Safe Harbor standard typically achieves on its own.