SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-deid-zip-code

Under Safe Harbor, how much of a patient's ZIP code may stay in de-identified data?

The first three digits, if that area has over 20,000 people.

Start playing free

  1. The full five digits
  2. The last two digits
  3. The first three digits, if that area has over 20,000 people ✔

Why: Places smaller than a state must be removed. The first three ZIP digits may stay only if all ZIP codes sharing them hold more than 20,000 people; otherwise they become 000.

Huh, didn't know that: Street address, city and county must all go, but the state can stay.

The dad joke
Why was the envelope so quiet? It was sealed.
Like this card?
Play the game

References

Answer: The first three digits, if that area has over 20,000 people. Places smaller than a state must be removed. The first three ZIP digits may stay only if all ZIP codes sharing them hold more than 20,000 people; otherwise they become 000.

  1. 45 CFR 164.514 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
    The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people
    Checked 2026-10-10.
  2. 45 CFR 164.514 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514
    All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsHow many identifiers must be removed under HIPAA's Safe Harbor method to de-identify health data?Work SkillsBesides Safe Harbor, what is HIPAA's other way to de-identify health data?Work SkillsUnder Safe Harbor, which part of a patient's admission date may stay in de-identified data?

That's stuff everyone should know.