Examples
Worked examples
- Is an instance
A dataset stripped of all 18 Safe Harbor identifiers (names, dates other than year, geographic detail smaller than state, contact and account numbers, biometric and image identifiers) and released with no restriction because it falls outside HIPAA's scope entirely.
Counter-examples
Looks similar, but isn't
- Not an instance
A Limited Data Set retaining dates and state-level geography, disclosed under a signed Data Use Agreement without individual authorisation — not fully de-identified, and not the same instrument as a Safe Harbor or Expert Determination dataset.
Editorial commentary
Under the Privacy Rule, a covered entity may use or disclose protected health information (PHI) for research only with the individual's written HIPAA authorisation, under an IRB-granted waiver of authorisation, as a limited data set with a Data Use Agreement, after de-identification, for reviews preparatory to research, or for research on decedents' information. The eighteen identifier categories defining de-identification under the safe-harbour method are enumerated in §164.514(b)(2). Research authorisations are study-specific, must contain core elements and required statements, and remain valid until revoked.
The two de-identification methods, precisely
45 CFR §164.514(a)-(b) sets out two, and only two, ways to remove data from HIPAA’s scope entirely. Safe Harbor requires removing all 18 identifier categories enumerated at §164.514(b)(2)(i) — name; geographic subdivisions smaller than a state; all elements of dates (except year) directly related to an individual; telephone and fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate/licence numbers; vehicle identifiers; device identifiers/serial numbers; URLs; IP addresses; biometric identifiers; full-face photographs and comparable images; and any other unique identifying number, characteristic, or code — combined with no actual knowledge that the remaining information could identify an individual. Expert Determination, the alternative under §164.514(b)(1), instead has a qualified statistician or other expert apply generally accepted statistical/scientific methods to conclude the re-identification risk is very small, and document that analysis — useful when Safe Harbor would strip data of scientific value the study needs to retain.
Limited Data Set, distinct from de-identified data
A Limited Data Set under §164.514(e) keeps some indirect identifiers (dates, larger geographic subdivisions) that a fully de-identified dataset would strip, and is disclosable for research without authorisation or a waiver — provided the recipient signs a Data Use Agreement restricting use, access, and re-disclosure, and prohibiting re-identification attempts. It is a middle option between full authorisation/waiver and full de-identification, not a synonym for either.
Related pages
See also HIPAA (general), HIPAA in clinical research, HIPAA accounting of disclosures, de-identification (general), and the Five Safes framework as a comparable, non-US model for the same underlying problem.
References
- HIPAA Privacy Rule, 45 CFR §164.500 et seq., and §164.514(a)-(b), (e) (eCFR).
- HHS Office for Civil Rights, Guidance on Research and HIPAA; HIPAA De-identification Guidance (Safe Harbor and Expert Determination).
Also known as
HIPAA · Privacy Rule · 45 CFR 164 Subpart E
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="HIPAA Privacy Rule"
vocab-term-identifier="https://casrai.org/dictionary/term/hipaa-privacy-rule" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"@id": "https://casrai.org/dictionary/term/hipaa-privacy-rule",
"name": "HIPAA Privacy Rule",
"identifier": "https://casrai.org/dictionary/term/hipaa-privacy-rule",
"description": "The US federal regulation at 45 CFR Parts 160 and 164 Subparts A and E that establishes national standards for the protection of individually identifiable health information held or transmitted by covered entities and their business associates, requiring authorisation, a waiver, or another permitted basis for any use or disclosure for research.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-regulatory#set",
"url": "https://casrai.org/dictionary/term/hipaa-privacy-rule",
"sameAs": [
"HIPAA",
"Privacy Rule",
"45 CFR 164 Subpart E"
],
"license": "https://creativecommons.org/licenses/by/4.0/",
"publisher": {
"@id": "https://casrai.org/#organization"
},
"author": {
"@id": "https://casrai.org/#editorial-team"
},
"datePublished": "2026-05-21T02:22:53",
"dateModified": "2026-08-23T05:20:18",
"inLanguage": "en-GB",
"isAccessibleForFree": true
}
