HIPAA safe harbor: the 18 identifiers for business data

HIPAA's safe-harbor rule lets you share data without a covered entity's authorization, as long as the 18 listed identifiers are removed. Below you'll find those identifiers described in plain language and the steps you need to keep your operating records compliant.

The 18 identifiers in plain language

Names in any form, full name, first name, middle name, nickname or initials, are one identifier. Any geographic detail smaller than a state, such as street address, city, county, precinct or zip code tied to a person, counts next. Dates that could pinpoint an individual, including day, month and year (but not the year alone), must be removed. Phone numbers of any type, personal or work email addresses that contain a name or other personal cue, and Social Security numbers are also on the list.

Health-related numbers include medical record numbers and health-plan beneficiary numbers. Financial identifiers cover bank, credit or any other account numbers linked to a person. Government-issued numbers such as driver's licenses, professional licenses or passport numbers fall under certificate or license numbers. Vehicle identifiers like license plates or VINs, and device serial numbers such as MAC addresses, IP addresses or RFID tags, are included as well.

Web URLs that embed personal information and raw IP address numbers are treated as identifiers. Biometric data, fingerprints, voice prints or facial geometry, and full-face photographs that can identify a person are also covered. Finally, any other unique number, characteristic or code that could single out an individual, such as an employee badge number or custom ID, completes the list.

If any of these appear in your support tickets, CRM notes, project logs or invoicing data, they must be removed or masked before the data qualifies as de-identified under safe harbor.

How the identifiers appear in typical business data

A support ticket often carries the customer's name, email and phone number. A sales order may list a billing address, invoice number and a credit-card reference. An internal knowledge-base article can embed a screenshot that shows an employee badge. Each of those pieces maps directly to one or more of the 18 identifiers.

Most companies keep data in several systems: a ticketing platform, a CRM, an accounting package and a document repository. Because identifiers can be scattered, a single-pass review misses hidden links, think of a "user-632" placeholder that matches a name in a separate directory. That's why a thorough de-identification effort blends automated scanning with manual cross-system checks.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

Our de-identification service and the safe-harbor workflow

When you ask us for a quote, we start with a short questionnaire about the systems you use and the volume of records you plan to share. We do not request raw data at this stage. After we receive a one-page summary, we match you with AI labs that need your type of data and bring back the best offer.

If you choose to proceed, we handle de-identification in six steps:

1. Map the data environment. We list every source system, the fields it holds, and the privacy laws that apply (HIPAA, CCPA, GDPR, etc.).
2. Export to a secure, logged workspace. Raw files move to an isolated area where every access is recorded; the originals are slated for deletion on a documented date.
3. Apply automated redaction. Our tools strip the 18 identifiers, replace names with stable placeholders such as "employee 632", and alter dates, locations and numbers the law requires.
4. Human verification. Trained reviewers read the cleaned files to confirm no identifier remains and that placeholders stay consistent across records.
5. Re-identification test. An independent team attempts to link the cleaned data back to individuals; their findings are documented and shared with you.
6. Deliver the de-identified set. You receive the cleaned data together with a provenance memo that explains how the work was performed and which legal sections were satisfied.

The contract spells out who runs each step and who covers the fee. In most brokered deals the AI lab buying the data pays the de-identification cost, but the parties can agree otherwise. Once the data is clean, you can move forward to sell it as a licensed data set for AI training.

Other privacy regimes with similar de-identification concepts

GDPR Recital 26 says data is anonymous when a person cannot be identified by any means reasonably likely to be used, considering all available information. CCPA Section 1798.140 allows a business to sell "de-identified" personal information if it cannot be reasonably re-identified. PIPEDA and Quebec Law 25 also require personal information to be stripped of identifiers before disclosure for secondary purposes.

The lists differ, yet the principle is the same: remove anything that could reasonably lead back to an individual. If you already have a GDPR or CCPA de-identification process, you can extend it to cover HIPAA by adding the nine health-specific identifiers (Social Security number, medical record number, health-plan beneficiary number, etc.).

Getting a de-identification quote from us

If you need to clean operational data so it complies with HIPAA safe harbor, click the button below and request a quote. We'll send you the questionnaire, walk you through the mapping stage, and give you a clear cost estimate based on your systems and record volume. No data moves until you approve the quote and the final contract.

Request a de-identification quote