HIPAA de-identification for AI: the 18 safe harbor identifiers and where AI data trips

The short answer

Picture a team sharing ‘anonymised’ notes with an AI vendor, and a patient’s name turning up in a dictated sentence. Under HIPAA, data counts as de-identified only after specific identifiers are removed or an expert signs off on the risk. Free text, audio, logs and prompts are where AI projects most often miss them.

Under HIPAA, health information is de-identified only if one of two things is true. Either a qualified expert applies statistical methods, finds the risk of identifying anyone is very small, and documents the analysis (expert determination), or 18 specified identifiers of the individual and of their relatives, employers and household members are removed and the covered entity has no actual knowledge that what remains could identify someone (safe harbor).¹ De-identified data isn’t PHI. For AI projects, the hard parts are free text, audio, images, logs and prompts, where identifiers hide in places a column-based scrub never looks.

This is a summary, not legal advice.

Two ways to de-identify

Sources:¹. Safe harbor is mechanical and predictable. Expert determination keeps more utility but needs a qualified person and documentation.¹

The 18 identifiers

Safe harbor requires removing these, for the individual and for relatives, employers and household members:¹

Number 18 is the catch-all, and with it the “no actual knowledge” condition: even after removing the list, if you know the rest could identify someone, the data isn’t de-identified under safe harbor.¹

Where AI data trips over the rule

Free-text notes. Identifiers appear anywhere: “her daughter Priya drove her from Edison on 3/14”. Pattern-based scrubbers miss some. If a dataset includes notes, test the scrubber’s misses on a sample before calling the set de-identified.

Audio. Ambient scribe recordings carry voice, a biometric identifier, plus whatever is said.¹ Audio is very hard to de-identify under safe harbor; treat it as PHI.

AI outputs. Models can reproduce identifiers from inputs, and sometimes introduce details that weren’t there. A pilot published in 2026 found hallucinations in 11.5% of reviewed AI scribe notes.⁴ A model-generated summary of PHI is PHI.

Logs and prompts. Prompt logs, traces, error messages and analytics events often hold names, record numbers and IP addresses. Teams that de-identify the training set and forget the logs still hold PHI.

Linkage. Rare diagnoses, small towns and exact dates combine into identification even when no single field is an identifier. That’s why the rule includes the actual knowledge condition and why expert determination exists.¹

Codes and re-identification

HIPAA lets a covered entity assign a code so it can re-identify records later, provided the code isn’t derived from information about the individual, can’t be translated to identify them, and isn’t used or disclosed for other purposes, with the re-identification mechanism kept private.¹

So a random study id is fine; a hash of the medical record number is not, because it’s derived from an identifier. That catches many AI pipelines that “pseudonymise” by hashing MRNs.

If data stays identifiable, the usual HIPAA rules apply, including making reasonable efforts to limit PHI to the minimum necessary for each use, disclosure or request (with exceptions such as treatment).² Vendors handling it on a covered entity’s behalf are generally business associates.³ Our BAA post covers that path.

A checklist for AI teams

• Decide the method up front: safe harbor or expert determination.¹
• List every place data lives: tables, notes, audio, images, prompts, logs, caches, embeddings.
• Remove all 18 identifier types from every place, including relatives’, employers’ and household members’.¹
• Test scrubbers on free text and record the miss rate.
• Use random study ids, never hashes of identifiers.¹
• Treat model outputs from PHI as PHI unless de-identified again.
• Keep audio and images out of “de-identified” sets unless an expert has assessed them.
• Write down why you believe there’s no actual knowledge of re-identification.
• For pilots, consider synthetic data instead; see our synthetic pilot post.

Questions people ask

What are the 18 HIPAA identifiers?

Names, small geographic units, dates (except year) and ages over 89, phone, fax, email, SSN, medical record, health plan, account and licence numbers, vehicle and device identifiers, URLs, IP addresses, biometrics, full-face photos, and any other unique identifying number, characteristic or code.¹

Is hashed data de-identified?

Not if the hash is derived from an identifier such as a medical record number; re-identification codes must not be derived from information about the individual.¹

Can we train an AI model on de-identified data without a BAA?

Properly de-identified data isn’t PHI, so HIPAA’s business associate rules don’t attach to it. The work is in making sure it really is de-identified.

For how agent access to identifiable data can be limited and recorded, see our healthcare page and the provenance spec. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.