HIPAA Safe Harbor identifier scanner

FAQ

What are the 18 HIPAA Safe Harbor identifiers?

Under 45 CFR 164.514(b)(2), Safe Harbor requires removing these identifiers of the individual and of relatives, employers, or household members: names; geographic subdivisions smaller than a state (including street address, city, county, and ZIP code, with a limited exception for the first three ZIP digits); all elements of dates except year, and ages over 89; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plates; device identifiers and serial numbers; web URLs; IP addresses; biometric identifiers such as finger and voice prints; full-face photographs and comparable images; and any other unique identifying number, characteristic, or code.

What is the difference between Safe Harbor and Expert Determination?

HIPAA allows two de-identification methods. Safe Harbor removes the 18 listed identifiers and requires that the covered entity has no actual knowledge the remaining information could identify the individual. Expert Determination relies on a qualified expert applying statistical or scientific methods to conclude that the risk of re-identification is very small, and documenting the methods and results.

If the scanner finds no identifiers, is my data de-identified?

No. The scanner uses pattern matching, so it can miss names, free-text descriptions, rare conditions, images, and biometrics, and it can flag harmless numbers. Safe Harbor also requires no actual knowledge that the remaining data could identify someone. Treat results as a prompt for manual review, not a de-identification determination.

Can ZIP codes, dates and ages stay in a Safe Harbor dataset?

Only in limited form. The year of a date may be kept, but other date elements must be removed. The first three digits of a ZIP code may be kept only if the area formed by all ZIP codes sharing those digits contains more than 20,000 people; otherwise they must be replaced with 000. Ages over 89 must be aggregated into a single category of 90 or older.

Is the text I paste uploaded anywhere?

No. The scanner runs entirely in your browser and the text is not sent to a server. Even so, follow your organization’s policy on handling protected health information on the device you are using.

Does HIPAA apply to my medical device or digital health company?

HIPAA applies to covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and to their business associates. A device or app company handling PHI on behalf of a covered entity is usually a business associate and needs a business associate agreement; companies outside HIPAA may still face state privacy laws or the FTC Health Breach Notification Rule.