--- title: "De-Identification of Health Data, Definition | MedTech Terms" description: "The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/de-identification#term", "name": "De-Identification of Health Data", "description": "Under HIPAA, health information is de-identified when it cannot reasonably be used to identify an individual. HHS recognizes two methods: the Safe Harbor method (removal of 18 specified identifiers and no actual knowledge that the residual data could re-identify) and the Expert Determination method (a qualified expert applies statistical/scientific methods and documents that re-identification risk is very small). De-identified data is not PHI and not subject to HIPAA.", "url": "https://medtechterms.com/terms/de-identification", "termCode": "de-identification", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/de-identification#article", "headline": "De-Identification of Health Data", "description": "The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule.", "url": "https://medtechterms.com/terms/de-identification", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/de-identification" }, "about": { "@id": "https://medtechterms.com/terms/de-identification#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "De-Identification of Health Data, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "HHS Guidance: De-Identification of PHI", "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html", "publisher": { "@type": "Organization", "name": "HHS OCR" } }, { "@type": "CreativeWork", "name": "NIST SP 800-188 De-Identifying Government Datasets", "url": "https://csrc.nist.gov/pubs/sp/800/188/final", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "HSCC - Health Sector Coordinating Council", "url": "https://healthsectorcouncil.org/", "publisher": { "@type": "Organization", "name": "HSCC" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hipaa#term", "name": "HIPAA", "alternateName": "HIPAA", "url": "https://medtechterms.com/terms/hipaa" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/phi-ephi#term", "name": "PHI and ePHI", "url": "https://medtechterms.com/terms/phi-ephi" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hitech-act#term", "name": "HITECH Act", "alternateName": "HITECH", "url": "https://medtechterms.com/terms/hitech-act" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "De-Identification of Health Data", "item": "https://medtechterms.com/terms/de-identification" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/de-identification#faq", "mainEntity": [ { "@type": "Question", "name": "Can de-identified data be re-identified?", "acceptedAnswer": { "@type": "Answer", "text": "Safe Harbor data is de-identified by HIPAA definition but may still be re-identifiable in adversarial settings. Expert Determination explicitly bounds residual risk. Neither is risk-free." } }, { "@type": "Question", "name": "Is GDPR de-identification the same?", "acceptedAnswer": { "@type": "Answer", "text": "No. GDPR requires data to be 'anonymized' (irreversibly), which is a higher bar. HIPAA de-identification may not satisfy GDPR. Cross-border programs typically design to the GDPR bar." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. De-Identification of Health Data [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # De-Identification of Health Data The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Under [HIPAA](/terms/hipaa), health information is de-identified when it cannot reasonably be used to identify an individual. HHS recognizes two methods: the [Safe](/terms/safe-note) Harbor method (removal of 18 specified identifiers and no actual knowledge that the residual data could re-identify) and the Expert Determination method (a qualified expert applies statistical/scientific methods and documents that re-identification risk is very small). De-identified data is not PHI and not subject to HIPAA. What the regulation says HHS OCR's 2012 Guidance Regarding Methods for De-identification of [Protected Health Information](/terms/phi-ephi) remains the definitive reference. NIST SP 800-188 (2023) and ISO/IEC 20889 cover broader de-identification techniques. Misuse of the de-identification label is a frequent OCR enforcement target. ## What this means in practice MedTech teams that want to use clinical data for AI/ML training, analytics, or research typically need de-identified data. Choosing [Safe](/terms/safe-note) Harbor is procedurally simpler but data-utility-poor; Expert Determination preserves more analytic value but requires documented expert work and ongoing risk monitoring. Common pitfalls - • Calling pseudonymized data 'de-identified' - pseudonymization preserves a re-identification key. - • Combining de-identified datasets that, together, re-identify (the mosaic effect). - • Skipping the Expert Determination documentation - without it, the data isn't legally de-identified. ## Frequently asked questions Can de-identified data be re-identified? [Safe](/terms/safe-note) Harbor data is de-identified by [HIPAA](/terms/hipaa) definition but may still be re-identifiable in adversarial settings. Expert Determination explicitly bounds residual risk. Neither is risk-free. Is GDPR de-identification the same? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity HIPAA(HIPAA) U.S. federal law governing the privacy and security of protected health information. ](/terms/hipaa)[ Cybersecurity HITECH Act(HITECH) U.S. law that strengthened HIPAA enforcement and introduced breach-notification requirements. ](/terms/hitech-act)[ Cybersecurity PHI and ePHI Individually identifiable health information (PHI) and its electronic form (ePHI) - the data class HIPAA protects. ](/terms/phi-ephi) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 HHS OCR· 1 NIST· 1 HSCC· 1 1. [1 HHS Guidance: De-Identification of PHI Verified HHS OCR · hhs.gov ](https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html) 2. [2 NIST SP 800-188 De-Identifying Government Datasets Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/pubs/sp/800/188/final) 3. [3 HSCC - Health Sector Coordinating Council Verified HSCC · healthsectorcouncil.org ](https://healthsectorcouncil.org/) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=de-identification) Learn in 60 seconds Card Lesson Quiz The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule. - · MedTech teams that want to use clinical data for AI/ML training, analytics, or research typically need de-identified data. - · Choosing Safe Harbor is procedurally simpler but data-utility-poor; Expert Determination preserves more analytic value but requires documented expert work and ongoing risk monitoring. - · De-identified data is not PHI and not subject to HIPAA. Remember this Watch out: Calling pseudonymized data 'de-identified' - pseudonymization preserves a re-identification key. Related terms - [HIPAA(HIPAA) ](/terms/hipaa) - [PHI and ePHI ](/terms/phi-ephi) - [HITECH Act(HITECH) ](/terms/hitech-act) You may also need Auto-suggested from Cybersecurity and shared keywords. - [NIST IR 8473, Cybersecurity Framework Profile for HPH(NIST IR 8473) ](/terms/nist-cswp-35) - [Threat Modeling ](/terms/threat-modeling) - [AAMI TIR57 ](/terms/aami-tir57) - [Health Industry Cybersecurity Practices(HICP) ](/terms/hicp) - [HITRUST CSF(HITRUST) ](/terms/hitrust) - [LINDDUN ](/terms/linddun) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)