Last verified: October 2026, against 45 CFR 164.514 and 164.502 on eCFR. General information, not legal advice — confirm with your compliance officer or attorney.
De-identified data, in HIPAA's sense, is health information that has been stripped or tested to the point where it no longer identifies anyone, using one of two methods the regulation spells out. Done properly, it falls outside the Privacy Rule, which is what makes a dashboard of lead counts or an anonymous case story usable in marketing. Done loosely, it is still PHI with the names deleted.
In short: HIPAA recognizes two ways to de-identify data: Safe Harbor, which removes 18 kinds of identifiers and requires no actual knowledge that the rest could identify someone, and Expert Determination, where a qualified expert documents that the re-identification risk is very small. "Anonymized" has no HIPAA meaning.
What de-identified data means under HIPAA
The standard sits in 45 CFR 164.514(a) (opens in a new tab): "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information." Since PHI is a subset of individually identifiable health information, explained in what is PHI, de-identified data is not PHI.
Section 164.502(d) (opens in a new tab) confirms the consequence: the Privacy Rule's requirements "do not apply to information that has been de-identified." It adds two limits. You may use PHI to create de-identified data, or give it to a business associate to do the work. And if de-identified data is later re-identified, it is PHI again.
Method 1: Safe Harbor
Safe Harbor is the checklist method in 164.514(b)(2). It has two parts, and both must be met.
- Remove the listed identifiers of the individual and of relatives, employers and household members. These are the 18 identifiers: names, sub-state geography, dates except year, phone and fax numbers, email addresses, Social Security, record, beneficiary, account and license numbers, vehicle and device identifiers, URLs, IP addresses, biometrics, full-face photos and any other unique code.
- Have no actual knowledge "that the information could be used alone or in combination with other information to identify an individual who is a subject of the information."
Safe Harbor includes two narrow allowances. The first three ZIP digits may stay where the combined area has more than 20,000 people under current Census data. Ages over 89 must be grouped as "90 or older."
You may also keep a re-identification code under 164.514(c) (opens in a new tab), but only if it is "not derived from or related to information about the individual" and you never disclose how to reverse it. A hashed email address fails the first test, because it is derived from the person's email.
Method 2: Expert Determination
The second method, in 164.514(b)(1), relies on a person "with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable." That expert must:
- determine "that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual"; and
- document "the methods and results of the analysis that justify such determination."
Expert Determination is useful when Safe Harbor strips too much. A practice that wants to publish outcomes by month, or keep three-digit ZIP codes for a low-population area, can ask an expert whether a specific data set, going to a specific recipient, meets the standard. The determination applies to that data and that recipient, so a new use means a fresh look.
Re-identification risk in small practices and small towns
The "actual knowledge" condition bites hardest where populations are small. A single-provider practice in a town of 4,000 people has far fewer patients behind every data point than a hospital system in a city.
Three combinations re-identify people without any of the 18 identifiers:
- Rare procedure plus place. "Our first transcatheter procedure in the county" points to one patient.
- Age band plus event plus month. "A woman in her seventies who came in after the March ice storm" may be obvious to neighbors.
- Occupation or role. "A local school principal" is a characteristic that can identify, even without a name.
If your staff could guess who a story is about, assume a reader can. Either get the patient's written authorization or drop the story.
Using de-identified and aggregate data in marketing
Aggregate counts are the safest marketing data a practice has. Compare two examples.
Illustrative example: a fictional orthopedic practice.
"We received 47 new-patient requests this month, up from 39 in August. Knee pain was the top reason." This is aggregate and identifier-free, and fine for a report, a board slide or a social post.
"A 68-year-old retired firefighter from Millbrook was back on the golf course six weeks after his revision surgery." With age, town, occupation and a less common procedure, this is likely identifiable. It needs authorization or a full rewrite.
Practical rules for marketing reports:
- Report counts by source, service and month, not lists of leads.
- Suppress tiny cells. "One patient from ZIP 041xx" is an identification risk even when the rule allows the ZIP3.
- Keep raw form submissions in your covered systems; send agencies the output only.
- Don't paste case details into AI tools without checking the method first. Our guide to AI tools and de-identified data covers what to strip.
Testimonials are a different matter: they are identifiable by design, so they need authorization under the HIPAA marketing rules.
Medfy works on the same principle. Patient data from its forms, chat and inbox stays in separate, encrypted HIPAA databases in the US or Canada, marketing uses aggregate numbers only, and ad platforms never receive patient data. See how Medfy handles patient data, or check what your current site shares with a free marketing audit.
De-identified vs limited data set vs 'anonymized'
| Item | De-identified (164.514(a)–(b)) | Limited data set (164.514(e)) | "Anonymized" |
|---|---|---|---|
| Still PHI? | No | Yes | Usually, unless it meets a HIPAA method |
| Identifiers kept | None of the 18 (Safe Harbor) or whatever the expert approves | Some: town, state, ZIP, dates | Undefined; often hashed emails or device IDs |
| Allowed uses | Any, including marketing | Research, public health, health care operations | Treat as PHI |
| Agreement needed | None once de-identified | Data use agreement | BAA if a vendor handles it |
A limited data set keeps dates and five-digit ZIP codes, which makes it useful for research but not for marketing. "Anonymized" is a vendor word. When you hear it, ask which HIPAA method was used.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Is de-identified data still PHI?
No, if it was de-identified correctly. Under 45 CFR 164.502(d)(2), the Privacy Rule's requirements do not apply to information de-identified under 164.514, through either Safe Harbor or an expert's determination. Two catches: a code that lets you re-identify the data is itself PHI if disclosed, and data that is later re-identified becomes PHI again. Confirm your method with your compliance officer or attorney.
What's the difference between de-identified and anonymized data?
De-identified has a legal meaning under HIPAA: the data passed Safe Harbor or an Expert Determination. Anonymized has no HIPAA definition, and vendors use it loosely for anything from hashing emails to dropping names. Hashed or masked data often still contains identifiers or codes that can be linked back to a person. Ask which HIPAA method was used, and treat a vague answer as PHI.
Can a practice share de-identified data with a marketing agency?
Yes. Properly de-identified data, such as monthly lead counts by service, is not PHI and needs no BAA. The catch is who does the de-identifying: if the agency receives raw form submissions to build the report, it is handling PHI and must sign a business associate agreement first. Keep de-identification inside your covered systems and send the agency only the output. Confirm the setup with your compliance officer or attorney.
Who can perform an Expert Determination?
The rule names no license or degree. It requires a person with appropriate knowledge of and experience with generally accepted statistical and scientific methods for rendering information not identifiable. That person must find the re-identification risk very small for the anticipated recipient and document the methods and results. Practices usually hire a statistician or a firm that specializes in this work.