MedTech Terms
    The authoritative reference
    All terms

    De-Identification of Health Data

    The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Under HIPAA, health information is de-identified when it cannot reasonably be used to identify an individual. HHS recognizes two methods: the Safe Harbor method (removal of 18 specified identifiers and no actual knowledge that the residual data could re-identify) and the Expert Determination method (a qualified expert applies statistical/scientific methods and documents that re-identification risk is very small). De-identified data is not PHI and not subject to HIPAA.
    What the regulation says
    HHS OCR's 2012 Guidance Regarding Methods for De-identification of Protected Health Information remains the definitive reference. NIST SP 800-188 (2023) and ISO/IEC 20889 cover broader de-identification techniques. Misuse of the de-identification label is a frequent OCR enforcement target.

    What this means in practice

    MedTech teams that want to use clinical data for AI/ML training, analytics, or research typically need de-identified data. Choosing Safe Harbor is procedurally simpler but data-utility-poor; Expert Determination preserves more analytic value but requires documented expert work and ongoing risk monitoring.
    Common pitfalls
    • •Calling pseudonymized data 'de-identified' - pseudonymization preserves a re-identification key.
    • •Combining de-identified datasets that, together, re-identify (the mosaic effect).
    • •Skipping the Expert Determination documentation - without it, the data isn't legally de-identified.

    Frequently asked questions

    Safe Harbor data is de-identified by HIPAA definition but may still be re-identifiable in adversarial settings. Expert Determination explicitly bounds residual risk. Neither is risk-free.

    Primary references

    3 sources
    Link health: 2 verified 1 needs review· last checked 2026-05-09
    HHS OCR·1NIST·1HSCC·1
    1. 1
      HHS Guidance: De-Identification of PHI
      Verified
      HHS OCRhhs.gov
    2. 2
      NIST SP 800-188 De-Identifying Government Datasets
      Needs review
      NISTcsrc.nist.gov
    3. 3
      HSCC - Health Sector Coordinating Council
      Verified
      HSCChealthsectorcouncil.org

    Inline markers like [1] jump to the matching reference above.