Key Facts

• HIPAA defines exactly 18 identifiers that turn health data into protected information, per the California Department of Health Care Services.
• Removing all 18 identifiers is the HIPAA Safe Harbor de-identification method, according to compliance guidance.
• Under Safe Harbor, ZIP codes keep only the first three digits, and only if the area has over 20,000 residents, per Safe Harbor rules.
• Safe Harbor requires dates limited to year only and ages over 89 grouped into a single '90 or older' category, according to de-identification guidance.
• Common lead-capture fields — names, phone numbers, emails, and account numbers — are 4 of the 18 HIPAA identifiers, per the DHCS list.
• Researchers have re-identified 'de-identified' health data by combining it with public records every year since 1997, Stanford HAI reports.
• De-identified health data exits HIPAA protection entirely and can be freely bought and sold in a multibillion-dollar industry, according to Stanford experts.