Last verified: October 2026, against 45 CFR 164.514 on eCFR. General information, not legal advice — confirm with your compliance officer or attorney.
The 18 HIPAA identifiers are the items that must be stripped from health information before it counts as de-identified under HIPAA's Safe Harbor method. For a practice, the list doubles as a field guide: it shows which details in a form, an analytics report or a testimonial make data about a patient's care identifiable, and therefore protected.
In short: The 18 HIPAA identifiers come from 45 CFR 164.514(b)(2). They run from names and addresses to IP addresses, URLs, device IDs and full-face photos, and apply to the patient and their relatives, employers and household members. Removing all 18 is required for Safe Harbor but isn't enough by itself.
Where the list of 18 identifiers comes from
HIPAA protects identifiable health information, explained in our guide to what is PHI. Information stops being identifiable when it is de-identified under 45 CFR 164.514 (opens in a new tab). The rule offers two routes: an expert's documented determination, or the Safe Harbor method, which removes a fixed list of identifiers "of the individual or of relatives, employers, or household members of the individual."
That fixed list is what everyone calls the 18 identifiers. It was written as a de-identification standard, not as a definition of PHI. Something can be PHI without containing any listed item: a detailed description of a rare case in a small town, for example. Our guide to de-identification methods compares both routes.
The 18 identifiers, one by one
The wording below follows 164.514(b)(2)(i), letters A to R:
- (A) Names.
- (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, ZIP code and their equivalent geocodes (with a partial exception for ZIP codes, below).
- (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 (partial rules below).
- (D) Telephone numbers.
- (E) Fax numbers.
- (F) Electronic mail addresses.
- (G) Social security numbers.
- (H) Medical record numbers.
- (I) Health plan beneficiary numbers.
- (J) Account numbers.
- (K) Certificate/license numbers.
- (L) Vehicle identifiers and serial numbers, including license plate numbers.
- (M) Device identifiers and serial numbers.
- (N) Web Universal Resource Locators (URLs).
- (O) Internet Protocol (IP) address numbers.
- (P) Biometric identifiers, including finger and voice prints.
- (Q) Full face photographic images and any comparable images.
- (R) Any other unique identifying number, characteristic, or code, except a re-identification code assigned under paragraph (c).
Item R is the catch-all. A patient portal username, a loyalty-program number or an internal lead ID can all fall under it. Our page on is an email address PHI walks through the common ones in context.
Identifiers hiding in marketing data: URLs, IPs, device IDs, photos
Marketing systems collect identifiers by default, often without anyone typing them in. This table maps each risk to where it shows up and how to handle it.
Illustrative example: the scenarios describe a fictional dermatology practice.
| Identifier | Where it shows up in marketing | Safer handling |
|---|---|---|
| Names, phone, email (A, D, F) | Contact and appointment forms, form-notification emails, email lists | HIPAA-compliant forms; notifications that say "new request" without details |
| URLs (N) | Thank-you pages like /thanks?name=dana&concern=psoriasis; page paths sent to analytics | Keep names and conditions out of URLs and query strings |
| IP addresses (O) | Analytics, server logs, ad pixels firing on condition pages | No third-party pixels on form, booking or condition pages |
| Device and ad IDs (M, R) | Mobile ad IDs and cookie IDs collected by ad and analytics tags | Treat them as identifiers; keep them away from patient-facing flows |
| Full-face photos (Q) | Before-and-after galleries, testimonial videos, social posts | Written authorization before marketing use |
| Biometrics (P) | Voice recordings in testimonial videos | Same authorization; store originals securely |
| Dates (C) | Appointment dates in CRM exports, birthdays for "happy birthday" emails | Strip from reports; keep in the protected system |
| Account numbers (J) | Payment-plan or membership exports to marketing tools | Never export; use counts instead |
The IP address row is where most practices leak data without knowing it. A 2024 federal court ruling (opens in a new tab) narrowed HHS's guidance on IP addresses collected on public pages, covered in IP addresses and tracking pixels. Photos are the next most common, especially on Instagram; see patient photos on social media.
Dates and ZIP codes: the partial rules
Two identifiers have exceptions written into the rule, and both are often misquoted.
ZIP codes. The first three digits may stay if, "according to the current publicly available data from the Bureau of the Census":
"(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000."
In practice, a report can say "new patients by ZIP3" only after checking each three-digit area against Census data. A rural practice may find several of its prefixes must become 000.
Dates and ages. The rule removes "all elements of dates (except year) for dates directly related to an individual" and "all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older."
So "2026" can stay, but "March 2026" cannot. An age of 47 can stay; an age of 93 becomes "90 or older," and so does a birth year that reveals it.
Removing identifiers isn't always enough
Safe Harbor has a second condition that people skip. Under 164.514(b)(2)(ii), the covered entity must not have "actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information."
That matters most in small practices. If a "de-identified" case summary describes the only patient in town who had a particular procedure, and your team knows that, it is not de-identified. The same goes for free-text fields: a note reading "teacher at the high school" contains none of the 18 items yet may identify someone.
If you want to share data that doesn't fit Safe Harbor, the alternative is an expert's documented determination. For research and operations, limited data sets keep some identifiers under a data use agreement, but they are not a route to marketing use.
Using the list as a checklist for vendors and reports
The list works well as a pre-flight check whenever data leaves your protected systems.
- Agency reports: ask for counts by source, service and month. If a report contains any of the 18 items, the agency is handling PHI and needs a BAA.
- Analytics setup: check that page paths and query strings contain no names, emails or conditions, and that ad tags don't load on form or booking pages.
- Exports to email or ad tools: if a column matches any item on the list, stop and ask whether the export is permitted at all.
- Testimonials and case stories: run the list, then ask the "actual knowledge" question.
Medfy is set up around this boundary. Patient information from Medfy's forms is stored in separate, encrypted HIPAA databases in the US or Canada, and ad platforms never receive patient data; marketing reports use aggregate numbers. See how Medfy handles patient data. To find identifiers your current site may be leaking to third parties, start with a free marketing audit.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
What are the 18 HIPAA identifiers?
Names; geographic units smaller than a state; dates (except year) tied to a person, plus ages over 89; phone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers; device identifiers; URLs; IP addresses; biometric identifiers; full-face photos; and any other unique identifying number, characteristic or code. The list is in 45 CFR 164.514(b)(2).
Is a ZIP code a HIPAA identifier?
Yes. A full ZIP code is a geographic subdivision smaller than a state, so it must come out under Safe Harbor. The rule lets you keep the first three digits only if the area formed by all ZIP codes sharing them has more than 20,000 people under current Census data; smaller areas must be changed to 000. Confirm your specific data set with your compliance officer or attorney.
Are IP addresses one of the 18 identifiers?
Yes. 'Internet Protocol (IP) address numbers' is item O on the Safe Harbor list, which is why analytics data and server logs tied to patient activity need care. Whether an IP address collected on a public web page is PHI is a separate question that turned on a 2024 court ruling about HHS's tracking guidance. Check your setup with your compliance officer or attorney.
If I remove all 18 identifiers, is the data de-identified?
Only if your practice also has no actual knowledge that what remains could identify someone, alone or combined with other information. A record stripped of all 18 items can still point to one person in a small town or a rare case. The other route is an expert's documented determination that re-identification risk is very small. General information, not legal advice: confirm with your compliance officer or attorney.