SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-deid-18-identifiers

How many identifiers must be removed under HIPAA's Safe Harbor method to de-identify health data?

18 identifiers.

Start playing free

  1. 18 ✔
  2. 12
  3. 25

Why: Safe Harbor lists 18 identifiers, lettered A through R, from names and addresses to photos and device serial numbers. Remove all 18, with no actual knowledge the rest could identify someone, and the data is de-identified.

Huh, didn't know that: Data that meets the de-identification standard is no longer individually identifiable, so the Privacy Rule no longer applies to it.

The dad joke
Why did the invisible man turn down the job offer? He couldn't see himself doing it.
Like this card?
Play the game

References

Answer: 18. Safe Harbor lists 18 identifiers, lettered A through R, from names and addresses to photos and device serial numbers. Remove all 18, with no actual knowledge the rest could identify someone, and the data is de-identified.

  1. 45 CFR 164.514 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
    (R) Any other unique identifying number, characteristic, or code
    Checked 2026-10-10.
  2. 45 CFR 164.514 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
    The covered entity does not have actual knowledge that the information could be used alone or in combination
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsBesides Safe Harbor, what is HIPAA's other way to de-identify health data?Work SkillsUnder Safe Harbor, how much of a patient's ZIP code may stay in de-identified data?Work SkillsUnder Safe Harbor, which part of a patient's admission date may stay in de-identified data?

That's stuff everyone should know.