SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-deid-relatives

Under Safe Harbor, whose identifiers must be removed besides the patient's own?

Relatives, employers and household members.

Start playing free

  1. The patient's relatives, employers and household members ✔
  2. Nobody else's
  3. Only the treating doctor's

Why: Removing the patient's own name isn't enough. The 18 identifiers must also be removed for relatives, employers and household members, since they could point back to the patient.

Huh, didn't know that: Device serial numbers and web addresses (URLs) are also on the remove list.

Like this card?
Play the game

References

Answer: The patient's relatives, employers and household members. Removing the patient's own name isn't enough. The 18 identifiers must also be removed for relatives, employers and household members, since they could point back to the patient.

  1. 45 CFR 164.514 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
    The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsHow many identifiers must be removed under HIPAA's Safe Harbor method to de-identify health data?Work SkillsBesides Safe Harbor, what is HIPAA's other way to de-identify health data?Work SkillsUnder Safe Harbor, how much of a patient's ZIP code may stay in de-identified data?

That's stuff everyone should know.