A blood-pressure reading is not protected health information. A blood-pressure reading next to a name, a ZIP code, and a date of birth absolutely is. That gap — between a health fact and a health fact tied to a person — is the entire mechanism of HIPAA, and it turns on a specific, finite list of eighteen identifiers. Know the list and you can look at any field in your database and say, with confidence, whether it is dragging the whole record into scope. Guess at it, and you will either over-restrict harmless data or, far worse, leak PHI you never realised you were holding.
Why the List Exists
The eighteen identifiers come from one specific place in the regulation: the Safe Harbor method of de-identification at 45 CFR §164.514(b)(2). HIPAA gives organisations a way to take health data out of scope — because de-identified data is no longer PHI and can be used and shared freely. Safe Harbor is the mechanical route to get there: strip all eighteen listed identifiers from the data (for the individual and their relatives, employers, and household members), confirm you have no actual knowledge that what remains could re-identify anyone, and the information is no longer protected.
Read the other direction, the list does something equally useful: it tells you exactly what makes health information identifiable in the first place. PHI is the combination of a health detail and a link back to a person. These eighteen items are that link. If a record contains a health fact and any one of them, it is PHI — regardless of what your product is called or how small your company is. That is why the list is the single most practical artefact in all of HIPAA: it converts an abstract question ("is this PHI?") into a concrete checklist.
The 18 Identifiers in Full
Here is the complete Safe Harbor list, in the order the regulation gives it, with plain-English examples of where each one shows up in a real product.
| # | Identifier | What it covers / examples |
|---|---|---|
| 1 | Names | Full name, initials, maiden name, nicknames — anything naming the individual, their relatives, employer, or household |
| 2 | Geographic data smaller than a state | Street address, city, county, precinct, and ZIP code (the first three ZIP digits are allowed only where the population is over 20,000; otherwise use 000) |
| 3 | Dates related to an individual | Birth date, admission and discharge dates, date of death, and all ages over 89 (which must be aggregated to "90 or older"). Only the year may remain |
| 4 | Telephone numbers | Landline, mobile, or any contact number |
| 5 | Fax numbers | Listed separately from phone numbers in the rule |
| 6 | Email addresses | Any address that reaches the individual |
| 7 | Social Security numbers | Full or partial SSNs |
| 8 | Medical record numbers | The MRN a provider assigns to a patient |
| 9 | Health plan beneficiary numbers | Insurance member and subscriber IDs |
| 10 | Account numbers | Billing, payment, or patient account references |
| 11 | Certificate / license numbers | Driver's licence, professional licence, and similar |
| 12 | Vehicle identifiers & serial numbers | Including licence plate numbers |
| 13 | Device identifiers & serial numbers | Serial numbers of implants, monitors, and connected medical devices |
| 14 | Web URLs | A personal URL that resolves to the individual |
| 15 | IP addresses | Any IP logged against the individual |
| 16 | Biometric identifiers | Fingerprints, voiceprints, retina and iris scans |
| 17 | Full-face photographs & comparable images | Any image from which the person can be recognised |
| 18 | Any other unique identifying number, characteristic, or code | The catch-all — any remaining code or trait that singles out one person, including many internal user IDs |
Numbers 1 to 17 are a fixed list. Number 18 — "any other unique identifying number, characteristic, or code" — is deliberately open-ended, and it is where teams get caught. A random-looking internal user ID, a device fingerprint, a study participant code, or a rare combination of attributes can all qualify. If a value can single out one specific person, treat it as an identifier even if it isn't on the numbered list.
The Identifiers Teams Miss
Most people can recite the obvious ones — name, SSN, medical record number. The exposure almost always lives in the identifiers that don't feel like "health data" at all, because they arrive through infrastructure rather than through a clinical form.
Dates are more restrictive than people expect
Identifier 3 removes far more than a birth date. Every date tied to an individual — admission, discharge, procedure, death — must go, leaving only the year. And any age over 89 has to be collapsed into a single "90 or older" bucket, because the very old are rare enough that an exact age can re-identify them. A dashboard that proudly shows "patient admitted 14 March" is handling an identifier.
Geography is granular
Identifier 2 isn't just street addresses. City, county, and full ZIP code all count. Only the first three digits of a ZIP may survive, and only where that three-digit area holds more than 20,000 people — otherwise even those digits must be zeroed. A "patients near you" feature is quietly processing an identifier.
IP addresses, URLs, and device IDs are PHI
This is the one that catches software companies hardest. Identifiers 13, 14, and 15 — device IDs, web URLs, and IP addresses — are exactly the values that analytics tools, error monitors, session-replay scripts, and server logs collect automatically. Drop a third-party tracker onto a page that also displays health information and you have very likely just sent PHI to a vendor with no agreement in place. The same hidden-collection problem exists under privacy law; we mapped it for GDPR in how your product collects personal data without realising, and the mechanism is identical here.
Two Ways to De-Identify
Safe Harbor — removing the eighteen identifiers — is one of two methods HIPAA recognises. The other is Expert Determination, and knowing when to reach for each keeps you from either over-scrubbing useful data or under-scrubbing risky data.
✓ Safe Harbor
- Mechanical: strip all 18 identifiers
- No statistician required
- Fast, cheap, and repeatable
- Best for straightforward data sets
- Fails if any identifier is left in
◐ Expert Determination
- A qualified expert assesses re-identification risk
- Can retain some identifiers if risk is very small
- Preserves more analytical value
- Documented, defensible methodology
- Best for rich or high-value data sets
Safe Harbor is the right default for most teams: it is a checklist anyone can run. Expert Determination earns its cost when the data is valuable enough that stripping all eighteen identifiers would destroy its usefulness — for research, analytics, or model training — and a statistician can certify that what remains carries only a very small risk of re-identification.
The Re-Identification Trap
Here is the part that surprises people: removing all eighteen identifiers is necessary but not always sufficient. Safe Harbor has a second condition — you must have no actual knowledge that the remaining information could be used, alone or in combination, to identify an individual. A famous line of research has shown that a surprising share of the population can be uniquely pinned down by just date of birth, sex, and ZIP code. Strip the direct identifiers and a rare diagnosis in a small town can still point unmistakably at one person.
Deleting the name column does not de-identify a data set. If a combination of the remaining fields still singles out an individual — an unusual condition plus a small geography, an outlier age, a one-of-a-kind timeline — the data is still PHI, and treating it as anonymous is exactly the kind of mistake that turns into a reportable breach. When re-identification is even plausible, use Expert Determination.
Applying the List in Practice
The list is only useful if it drives what you build. These four moves turn the eighteen identifiers from a reference into a control.
Map every field, log, and third-party integration against the eighteen. The goal is a clear picture of exactly where identifiable health data enters, rests, and leaves your systems — including the IPs and device IDs that arrive silently.
If you don't need an identifier for the task, don't collect it. The Privacy Rule's minimum-necessary standard and the identifier list point the same way: the smallest set of identifiers you can operate on is the smallest attack surface you have to defend.
For dashboards, research, and model training, run Safe Harbor as a default and reach for Expert Determination when the data is rich enough that re-identification is a real risk. Never ship "we removed the names" as if it were de-identification.
The most common leak isn't the data store — it's a tracker, pixel, or session recorder capturing IPs, URLs, and device IDs from a page showing health data. Audit client-side tooling against identifiers 13 to 15 specifically.
If you want the bigger frame around this list — what PHI is, who is regulated, and the rules that govern it — start with What Is PHI? and HIPAA explained for startups.
Final Thought
The eighteen identifiers are the most quietly powerful list in HIPAA, because they turn a philosophical question into a mechanical one. You do not have to reason about whether a record "feels" sensitive; you check it against a finite list and you have your answer. The teams that stay out of trouble treat the list as a live control — wired into their data inventory, their minimisation decisions, and their front-end audits — rather than a document they read once and filed.
The test: pick the single richest health record in your system and walk it field by field against these eighteen. If you can account for every identifier — where it came from, why it's there, and whether it needs to be — you understand your PHI. If a field surprises you, that surprise is your first finding.
Frequently Asked Questions
They are names; geographic data smaller than a state; all dates except year tied to an individual; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or licence numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number, characteristic, or code.
They define the Safe Harbor method of de-identification under 45 CFR §164.514(b)(2). Remove all eighteen from a data set — and have no actual knowledge the remaining data could re-identify anyone — and the information is no longer PHI, so HIPAA stops applying to it. Read the other way, the list defines exactly what makes health information identifiable.
Yes. IP addresses are the fifteenth identifier on the list. If an IP is stored alongside health information in a way that ties it to an individual, that record is PHI — which is why analytics, logging, and error-monitoring tools are a common and overlooked source of HIPAA exposure.
Under Safe Harbor, only if you also have no actual knowledge that the remaining information could be used alone or in combination to identify someone. Rare conditions, unusual combinations, or small geographic populations can re-identify a person even after all eighteen are stripped. When that risk exists, Expert Determination is the safer method.