Healthcare operations glossary › De-identification
Definition
De-identification means removing or masking identifiers so that health information can no longer identify a patient and is no longer treated as protected health information (PHI). It matters because properly de-identified data is no longer subject to HIPAA's limits on how PHI can be used and disclosed.
In practice at a clinic or small practice
Staff usually run into de-identification during routine work:
- An office manager sends monthly no-show or visit-volume reports to a consultant or billing partner.
- A practice shares aggregate numbers with a vendor or a professional association.
- A nurse wants to use a patient case as a training example in a staff meeting.
The common trap is assuming that removing the name is enough. Cropping a name out of a schedule screenshot or a message does not de-identify it. A date of birth, an appointment date, a ZIP code, a phone number, a medical record number or a photo can still point to one patient. Under the Safe Harbor method, any date more specific than the year counts as an identifier. ZIP codes have their own limits.
Practical takeaway: If you are not sure whether something is de-identified, treat it as PHI. Keep it in systems and tools covered by a signed business associate agreement (BAA), and ask your privacy officer before sharing it.
Not to be confused with
| Term | Is it still PHI? | What it means |
|---|---|---|
| De-identified data | No, if one of the two HIPAA methods is met | Meets Safe Harbor or Expert Determination (see below) |
| Limited data set | Yes | Direct identifiers removed, but dates, city, state and ZIP code may remain. It can be shared only for research, public health or health care operations, and only under a data use agreement |
| Anonymization, masking, redaction | Depends | General industry terms with no HIPAA definition. Masking a few fields is not HIPAA de-identification unless one of the two methods is satisfied |
What the rules say
The primary source is the HIPAA Privacy Rule, at 45 CFR 164.514(a)–(b). HHS's Office for Civil Rights has also published guidance on the two de-identification methods.
HIPAA recognizes two methods.
1. Safe Harbor
- Remove the 18 identifiers listed in the rule.
- The identifiers must be removed for the patient and also for the patient's relatives, employers and household members.
- The organization must have no actual knowledge that the remaining information could identify the person, alone or combined with other information.
2. Expert Determination
- A qualified expert applies generally accepted statistical or scientific methods.
- The expert determines that the risk of re-identification is very small.
- The expert documents the methods and results.
Re-identification codes: A covered entity may assign a code so it can re-identify records later. The code must not be derived from the patient's information, and the re-identification method must not be disclosed.
Re-identified data is PHI again: Once information is re-identified, it is PHI again and HIPAA's protections apply.
This entry explains terms. It is not legal advice. Confirm specific cases with your privacy officer or counsel.
Related reading
- Protected health information (PHI): what counts as identifiable information in the first place.
- Minimum necessary standard: how to share only what a task needs when data cannot be de-identified.
- HIPAA Privacy Rule: the broader rules on use and disclosure.
For discussing identifiable operational details internally under a BAA, see HIPAA-compliant chat for staff.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.