Sources / Press and newsletters

HIPAA Privacy Rule: the de-identification standard, United States (federal)

11 records were read from this source, dated 15 Oct 2026 to 17 Oct 2026.

Its permanent copy is being made in the Wayback Machine.

Last checked 17 Oct 2026

What was read from it

Records read from this source
Record	Kind	As stated	Dated
HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))	Law or ruling	Health data that meets this standard is no longer individually identifiable, so it is no…	17 Oct 2026
HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))	Law or ruling	The first route: a qualified expert judges, for a named or anticipated recipient, that…	17 Oct 2026
HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))	Law or ruling	The second route: remove eighteen listed kinds of identifier, and not only the patient's…	17 Oct 2026
HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))	Law or ruling	Anything more precise than a state goes. A three-digit ZIP prefix may stay only where…	17 Oct 2026
HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))	Law or ruling	Only the year of a date tied to a person may stay, and ages over 89 (and any date that…	17 Oct 2026
HIPAA Safe Harbor: any other unique number, characteristic or code (45 CFR 164.514(b)(2)(i)(R))	Law or ruling	The list ends with a catch-all: any unique number, characteristic or code that points to…	17 Oct 2026
HIPAA Safe Harbor: the no actual knowledge condition (45 CFR 164.514(b)(2)(ii))	Law or ruling	Removing the eighteen kinds is not enough if the covered entity actually knows that what…	17 Oct 2026
HIPAA Privacy Rule: re-identification codes (45 CFR 164.514(c))	Law or ruling	A record key may survive de-identification only if it is not derived from the person's…	17 Oct 2026
HIPAA Privacy Rule: the limited data set (45 CFR 164.514(e)(1)-(3))	Law or ruling	A limited data set is still protected health information. It keeps dates, town, state…	17 Oct 2026
HIPAA Privacy Rule: what a data use agreement must say (45 CFR 164.514(e)(4))	Law or ruling	The data use agreement limits the recipient's uses, binds its agents and forbids…	17 Oct 2026
Details that identify together are coarsened and measured	De-identification rule	In tables, postcodes are cut to their first part (US ZIP codes to three digits, or 000…	15 Oct 2026

HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))
Kind
Law or ruling
As stated
Health data that meets this standard is no longer individually identifiable, so it is no…
Dated
17 Oct 2026
HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))
Kind
Law or ruling
As stated
The first route: a qualified expert judges, for a named or anticipated recipient, that…
Dated
17 Oct 2026
HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))
Kind
Law or ruling
As stated
The second route: remove eighteen listed kinds of identifier, and not only the patient's…
Dated
17 Oct 2026
HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))
Kind
Law or ruling
As stated
Anything more precise than a state goes. A three-digit ZIP prefix may stay only where…
Dated
17 Oct 2026
HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))
Kind
Law or ruling
As stated
Only the year of a date tied to a person may stay, and ages over 89 (and any date that…
Dated
17 Oct 2026
HIPAA Safe Harbor: any other unique number, characteristic or code (45 CFR 164.514(b)(2)(i)(R))
Kind
Law or ruling
As stated
The list ends with a catch-all: any unique number, characteristic or code that points to…
Dated
17 Oct 2026
HIPAA Safe Harbor: the no actual knowledge condition (45 CFR 164.514(b)(2)(ii))
Kind
Law or ruling
As stated
Removing the eighteen kinds is not enough if the covered entity actually knows that what…
Dated
17 Oct 2026
HIPAA Privacy Rule: re-identification codes (45 CFR 164.514(c))
Kind
Law or ruling
As stated
A record key may survive de-identification only if it is not derived from the person's…
Dated
17 Oct 2026
HIPAA Privacy Rule: the limited data set (45 CFR 164.514(e)(1)-(3))
Kind
Law or ruling
As stated
A limited data set is still protected health information. It keeps dates, town, state…
Dated
17 Oct 2026
HIPAA Privacy Rule: what a data use agreement must say (45 CFR 164.514(e)(4))
Kind
Law or ruling
As stated
The data use agreement limits the recipient's uses, binds its agents and forbids…
Dated
17 Oct 2026
Details that identify together are coarsened and measured
Kind
De-identification rule
As stated
In tables, postcodes are cut to their first part (US ZIP codes to three digits, or 000…
Dated
15 Oct 2026

Figures it feeds

11Smallest group a delivery may contain
5Group size below which a sample is flagged
90+Age from which ages are grouped