HIPAA De-Identification: Removing the 18 Safe Harbor Identifiers

De-identified health information is no longer PHI, which means it can be shared for research, analytics, or quality work without the usual HIPAA restrictions. But "de-identified" has a precise meaning under the HIPAA Privacy Rule, and stripping a name off a chart doesn't get you there. This guide covers the two approved methods, the full list of 18 Safe Harbor identifiers, and how to remove them from a PDF without ever uploading the file.

The two de-identification methods

The HIPAA Privacy Rule recognizes two ways to de-identify data:

1. Expert Determination. A person with appropriate statistical and scientific expertise determines that the risk of re-identification is very small, and documents the methods and results. This is flexible but requires a qualified expert.
2. Safe Harbor. You remove all 18 specified categories of identifiers, and you have no actual knowledge that the remaining information could be used, alone or in combination, to identify the individual. This is the checklist approach most organizations use for documents.

The rest of this guide focuses on Safe Harbor, because it maps cleanly to redacting a PDF.

The 18 Safe Harbor identifiers

To de-identify a record under Safe Harbor, remove every one of these, for the individual and for their relatives, employers, and household members:

1. Names
2. Geographic subdivisions smaller than a state: street address, city, county, precinct, and ZIP code (the first three ZIP digits may remain only if the area they cover has more than 20,000 people; otherwise use 000)
3. All elements of dates (except year) directly related to the individual: birth date, admission and discharge dates, date of death. All ages over 89 and any date indicating such an age are aggregated to "90 or older"
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate and license numbers
12. Vehicle identifiers and serial numbers, including license plate numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers, including finger and voice prints
17. Full-face photographs and comparable images
18. Any other unique identifying number, characteristic, or code

After removing all 18, you must also have no actual knowledge that what remains could re-identify the person.

How to remove them from a PDF (no upload)

Because these are still patient records until they're fully de-identified, they shouldn't be uploaded to a third-party service. PDF Zone processes everything in your browser, so the file is never transmitted, and its redaction rasterizes the covered area so the identifiers can't be recovered.

1. Open the Edit PDF tool.
2. Drag in the record.
3. Work through the 18 categories one at a time. Use Ctrl + F to locate each identifier (names, dates, MRNs, account numbers) so none are missed, including in headers, footers, and tables.
4. Draw a redaction box over every occurrence and apply.
5. Download the de-identified copy.

Watch the details Safe Harbor is strict about

• Dates: keep only the year. Redact months and days tied to the individual, and aggregate ages 90+.
• ZIP codes: redact to the state level, or keep only the first three digits where the population rule allows.
• "Any other unique code": case numbers, study IDs, and internal reference numbers count if they can be traced back to the person.
• Free-text notes: clinical narratives often bury identifiers in prose. Read them, don't just scan structured fields.

Don't overlook metadata

De-identifying the page isn't enough if the file's properties still name the patient or the author. Clear document metadata with Edit Metadata and remove annotation layers with Flatten PDF.

Verify the result

1. Open the finished file fresh.
2. Confirm no redacted area is selectable and no identifier is searchable with Ctrl + F.
3. Run Extract Text and scan the output for any identifier that slipped through.

Frequently Asked Questions

What are the 18 HIPAA Safe Harbor identifiers?

They are the categories of identifying information that must be removed to de-identify a record under Safe Harbor: names; geographic detail smaller than a state; dates tied to the person (except year); phone and fax numbers; email; SSN; medical record numbers; health plan numbers; account numbers; certificate/license numbers; vehicle identifiers; device identifiers; URLs; IP addresses; biometric identifiers; full-face photos; and any other unique identifying code.

What's the difference between Safe Harbor and Expert Determination?

Safe Harbor is a fixed checklist: remove all 18 identifier categories and have no actual knowledge the rest could re-identify the person. Expert Determination instead relies on a qualified expert who assesses and documents that the re-identification risk is very small. Safe Harbor is simpler for documents; Expert Determination is more flexible for complex datasets.

Does removing names make a record de-identified?

No. A name is only one of 18 categories. Dates, ZIP codes, record numbers, and other unique codes can all re-identify a person, so all 18 categories must be handled for Safe Harbor de-identification.

How do I de-identify a PDF without uploading it?

Use a tool that processes files locally. Open PDF Zone's Edit PDF tool, redact each of the 18 identifier categories, clear the metadata, and download. Nothing is uploaded because the work happens in your browser.

Can I keep the year of a date?

Yes. Safe Harbor allows the year to remain; it's the more specific date elements (month, day) directly related to the individual that must be removed, and ages over 89 aggregated to "90 or older."

What do I do with ZIP codes?

Remove geographic detail smaller than a state. You may keep the first three digits of a ZIP only if the geographic area they represent has more than 20,000 people; otherwise those three digits are changed to 000.

Is de-identified data still covered by HIPAA?

Information that has been properly de-identified under Safe Harbor or Expert Determination is no longer PHI and is not subject to the same HIPAA restrictions. Getting the de-identification right is what matters, which is why the full 18-category removal and verification steps are essential.

Is PDF Zone HIPAA compliant?

A tool can't be "HIPAA compliant" on its own; compliance depends on your organization and workflow. What PDF Zone offers is processing that runs entirely on your device, so records are never uploaded, helping you de-identify and share documents while keeping PHI under your control.

---

Related: How to Redact PHI from Medical Records · Remove Hidden Data from a PDF · Edit PDF · Extract Text