The 18 HIPAA identifiers, and where they hide in real documents

HIPAA gives two ways to de-identify health information. The more prescriptive one, the Safe Harbor method, has two conditions: remove 18 kinds of identifiers, belonging to the patient and to their relatives, employers and household members, and have no actual knowledge that what's left could still identify the person. Meet both and the information is no longer protected health information. The other route, Expert Determination, is covered further down.

The list itself is short. Applying it to real documents is harder, because identifiers turn up in places a text search never looks.

The 18 identifiers

These come from 45 CFR 164.514(b)(2). Each applies to the patient and to their relatives, employers and household members.

1. Names. First names, nicknames and initials included.
2. Geographic subdivisions smaller than a state. Street address, city, county, precinct, ZIP code and their geocodes. The first three digits of a ZIP code may stay if that three-digit area holds more than 20,000 people.
3. Dates directly related to the person, except the year. Birth, admission, discharge and death dates, and any element of them: "seen again on the 14th" still contains one. Ages over 89 must be grouped as "90 or older".
4. Telephone numbers.
5. Fax numbers.
6. Email addresses.
7. Social Security numbers.
8. Medical record numbers.
9. Health plan beneficiary numbers.
10. Account numbers.
11. Certificate and license numbers.
12. Vehicle identifiers and serial numbers, including license plates.
13. Device identifiers and serial numbers.
14. Web URLs.
15. IP addresses.
16. Biometric identifiers, including finger and voice prints.
17. Full-face photographs and comparable images.
18. Any other unique identifying number, characteristic or code. A catch-all: badge numbers, employee IDs, a rare job title in a small town.

Where identifiers hide in real documents

A text search, or the regular expressions inside most redaction tools, finds what is in a document's text layer, in the format it expects. Real records break both assumptions.

Scanned and faxed pages

A scanned page is a picture of text. Until optical character recognition (OCR) turns it into characters, a search finds nothing on it. Skewed scans, faint faxes and small print make OCR less reliable, and the misses tend to land in the dense, cramped areas, such as headers and label stickers, where identifiers cluster. Fax cover sheets add names and phone numbers that aren't in the record at all.

Handwriting, signatures and stamps

Margin notes, sticky notes scanned along with the page, signatures and date stamps sit on top of the typed text. A name written beside a lab result is as much an identifier as one typed in the header, and a signature usually spells out a name. These are the parts of a page most likely to need a person's eye.

Barcodes and QR codes

Patient labels, wristbands and specimen stickers carry barcodes that commonly encode the medical record number, and sometimes the name or date of birth. Nothing in the text layer shows what a barcode contains, so it survives a text-only redaction intact, and any phone camera can read it.

Photos and scanned cards

Full-face photos are on the list outright. So are the images that hide inside other documents: a copied driver's license, a scanned insurance card with the member's name and plan number, a clinical photo that shows the face.

Free text

Narrative notes are where patterns fail most. Names appear without titles, dates appear without a year ("admitted on the 3rd"), and places appear as descriptions rather than addresses ("the house on Wexford Drive"). Ages over 89 hide in sentences like "a 92-year-old widow", which must become "90 or older".

The file itself

Before the page content, there is the file. A filename such as martinez_rosa_labs.pdf is an identifier. So are author and title fields in the document properties, comments, form-field values and attachments.

Safe Harbor or Expert Determination?

The rule's other method, Expert Determination, has a qualified expert apply statistical methods to show that the risk of identifying anyone is very small, and document how they reached that conclusion.

• Safe Harbor is a checklist. It is predictable and needs no outside expert, but it is blunt: every date shrinks to a year and every location to a state or a three-digit ZIP.
• Expert Determination can keep more detail, such as some dates or regions, when a study needs it. The cost is the expert's time and a documented analysis behind every release.

For documents being released to a researcher, payer or opposing counsel, Safe Harbor is usually the practical choice. HHS explains both methods in its de-identification guidance.

A checklist before a document leaves

• Every page has been read by OCR, and someone has looked at the pages it struggled with.
• Names, dates and places of relatives, employers and household members are gone, not just the patient's.
• Dates are reduced to the year, and ages over 89 read "90 or older".
• Locations are reduced to the state, or to a permitted three-digit ZIP.
• Barcodes, QR codes, photos, signatures and handwriting have been checked.
• The filename, document properties, comments and form fields are clean.
• Redacted text is removed, not covered, so nothing can be copied out from under a redaction.
• A person has reviewed the result, and knows of nothing left that could identify the patient.

Where DocArmor fits

DocArmor's HIPAA Safe Harbor template starts from this list. It reads scanned and faxed pages with OCR and finds face photos, biometrics and barcodes visually. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped. Every finding goes to a reviewer before export, because the rule's last condition, actual knowledge, is a judgment a person has to make.