The 18 HIPAA Identifiers: Full List and De-identification Guide

This comprehensive guide outlines the 18 HIPAA identifiers and how to remove them to comply with the Privacy Rule’s Safe Harbor de-identification method. Improperly de-identified data is a leading cause of costly HIPAA violations. To safely use healthcare data for analytics, AI training, and research, organizations must strip these 18 elements—ranging from names and medical record numbers to granular dates, geographic subdivisions, and biometric data.

However, removing these identifiers is only step one. You must also satisfy the "actual knowledge" condition, ensuring no residual data could re-identify a patient. The guide contrasts the checklist-based Safe Harbor approach with the Expert Determination method, which preserves greater data utility for complex AI models.

Explore the six steps to securely remove identifiers from structured and unstructured data, review the 2026 penalty tiers (reaching $2.19M), and see how Limina’s NLP platform protects PHI with 99.5% accuracy.