The 18 HIPAA Identifiers: The Safe Harbor List

The 18 HIPAA identifiers, also called patient identifiers, are the items that the Safe Harbor method in 45 CFR 164.514(b)(2)(i) says must be removed from health information. In short, they are names, geographic subdivisions smaller than a state, date elements other than year (and ages over 89), telephone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face images, and any other unique identifying number, characteristic or code. This is a summary. The exact words are below.

This article is not legal advice. It does not say that a tool or a file meets HIPAA rules, and using a tool does not make data de-identified. Ask your privacy officer or a lawyer about your own documents. All names and numbers in this article are made up.

What are the 18 HIPAA identifiers?

This list uses the words and the order of 45 CFR 164.514(b)(2)(i) in the eCFR. The letters are the letters in the regulation. The list applies to identifiers "of the individual or of relatives, employers, or household members of the individual".

1. (A) Names
2. (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000
3. (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
4. (D) Telephone numbers
5. (E) Fax numbers
6. (F) Electronic mail addresses
7. (G) Social security numbers
8. (H) Medical record numbers
9. (I) Health plan beneficiary numbers
10. (J) Account numbers
11. (K) Certificate/license numbers
12. (L) Vehicle identifiers and serial numbers, including license plate numbers
13. (M) Device identifiers and serial numbers
14. (N) Web Universal Resource Locators (URLs)
15. (O) Internet Protocol (IP) address numbers
16. (P) Biometric identifiers, including finger and voice prints
17. (Q) Full face photographic images and any comparable images
18. (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section

We read the regulation on November 4, 2026, and the eCFR showed that Title 45 was up to date as of November 2, 2026. The rule can change, so read the current text before you rely on this list.

What do the ZIP code, date and age rules mean?

These are the items that are easy to simplify too much. The HHS examples here are from its de-identification guidance.

• ZIP codes. You can keep the first three digits only if the area made from all ZIP codes with those three digits has more than 20,000 people, by current Census data. If the area has 20,000 people or fewer, the three digits must change to 000. HHS gives a list of 17 such prefixes from the 2000 Census, and it says not to rely on that list if more current data has been published.
• Dates. For dates directly related to the person, only the year can stay. HHS says that "January 1, 2009" cannot be reported at that level of detail, but that it could be reported as "2009". HHS also says that dates of test measures, such as those from a laboratory report, are directly related to the person.
• Ages over 89. An age over 89 cannot stay, and neither can a date element, including the year, that shows such an age. These can be grouped into a single category of age 90 or older.
• Parts of an identifier. HHS says that patient initials, or the last four digits of a Social Security number, do not meet the Safe Harbor requirement.
• Free text. HHS says that a listed identifier "must be removed regardless of its location in a record if it is recognizable as an identifier". So a name in a sentence of a letter counts in the same way as a name in a form field.
• Other names. HHS says that there is no explicit requirement to remove the names of providers or workforce members. It also says that a covered entity would need to consider whether other names must go, because of the actual knowledge condition below.
• Other numbers. HHS gives clinical trial record numbers as an example of item (R). Paragraph (c) of the regulation lets a covered entity assign a re-identification code, with conditions: the code must not be derived from or related to information about the person, and it must not be possible to translate it to identify the person. The covered entity also must not use or disclose the code for another purpose, or disclose how re-identification works.

What does "de-identified" mean under Safe Harbor?

The general standard is in 45 CFR 164.514(a): health information is not individually identifiable if it "does not identify an individual" and there is "no reasonable basis to believe that the information can be used to identify an individual".

The Safe Harbor method has two conditions, and both must be true:

1. The identifiers are removed. This means all 18 items, for the person and for the person's relatives, employers and household members.
2. There is no actual knowledge. In the words of the regulation, "The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information."

HHS explains actual knowledge as "clear and direct knowledge". One of its examples is a record that gives a patient's occupation as "former president of the State University". HHS says that it is not sufficient to remove only the listed identifiers from that record. So a document with no listed identifiers can still fail this condition. HHS also says that both de-identification methods leave some risk of identification.

Safe Harbor is not the only method. HHS describes two: Safe Harbor and Expert Determination, in which a person with appropriate knowledge of and experience with generally accepted statistical and scientific methods determines that the risk of identifying a person is very small, and documents the methods and results.

We could not open the HHS page directly with our tools, because hhs.gov rejected the automated request. We read an archived copy from October 26, 2026. That copy says "Content last reviewed February 3, 2025".

What data is not a HIPAA identifier?

Data that the 18 items do not name is not always safe to keep, because item (R) and the actual knowledge condition still apply. HHS gives the example of an occupation that, with almost any other data, "like age or state of residence", can identify a patient. With that limit, there is some data that these items do not require you to remove: a state, because item (B) covers subdivisions "smaller than a State"; a year, because item (C) excepts the year, unless it shows an age over 89; and the first three digits of a ZIP code, under the rule above.

What counts as protected health information (PHI) is a different question. HHS says that a health plan report that only noted that the average age of its members was 45 years would not be PHI. It also says that a name or a phone number in a public phone book would not be PHI, because it is not related to health data, but that such information would be PHI if it was listed with "health condition, health care provision or payment data". These examples are about PHI status. They do not take names or telephone numbers off the Safe Harbor list. To meet the Safe Harbor method, a listed identifier must still be removed "regardless of its location in a record if it is recognizable as an identifier".

Which identifiers can the PDF Redactor find?

It finds some of them. On November 4, 2026, we ran the PDF Redactor in Chrome on one made-up medical letter, first with AI off and then with AI on (the English model). The letter has an example of each item that can appear in text, and drawings of a face and a fingerprint. "Found" means that a bar covered each example of that item. "Partial" means that the tool missed an example or a part of one. This table is the result of one test, not a promise about your document.

Read these limits with the table:

• AI results can change when the text changes. The results were the same when we ran the test a second time. But when we removed 2 unrelated lines from the letter, the certificate number and the geocode lost their bars.
• "Found" is for one format. A number in another format can get no bar. Read every page, also for the rows that say "Found".
• The tool hides. It does not rewrite. It puts a black bar over a value. It does not change a ZIP code prefix to 000 or change an age to "90 or older", and it does not decide whether the letter meets the actual knowledge condition.
• A scan is different. A PDF that is only a picture of a page got 0 bars in our test, with AI on. In this type of file, mark everything by hand.
• We did not test real documents, many pages, other languages, other browsers or other formats of the examples.

How do you mark the rest by hand?

1. Open your PDF in the PDF Redactor, and turn on AI.
2. Type what the tool missed in "Always hide these words", with a comma between the items. The comma separates the items, so type a value that has a comma as two items.
3. Drag a bar over each image, signature, handwritten note or other area.
4. Read every page. Use the 18 items above as your list, and think about what else in the letter can identify the person.
5. Download the redacted PDF. If the original file name has a name or a number in it, rename the new file, because the download name includes the original name.

In our test, these steps put a bar on each labeled example in the letter and on both pictures. But the last two sentences of the letter still showed "Example" and "Testperson", because we typed only the values that had no complete bar on the labeled lines. This is why you must read every page.

The exported file had no text when we read it with pdftotext, none of the made-up values that we searched for in its raw bytes, and no original title or author. These results are about the text in the file. They do not mean that the file is de-identified, because you must still remove all 18 items and meet the actual knowledge condition. For more about bars and hidden text, see how to black out text in a PDF. To test a PDF that someone else redacted, use the Redaction Checker.

Your file stays on your device or secure network and never touches our servers. The optional AI model downloads once from Hugging Face, and the download contains only the model, not your data. You can read what the page loads in our privacy policy.