HIPAA Compliance and Document Redaction: A Practical Checklist

A hospital shares patient data with a research partner for a quality improvement study. The records have been processed — names removed, SSNs stripped, medical record numbers deleted. Looks clean.

But the records still contain admission and discharge dates, three-digit ZIP codes for a rural county with fewer than 20,000 residents, and ages reported as specific numbers for patients over 89.

Under HIPAA’s Safe Harbor method, that dataset is not de-identified. The research partner is receiving Protected Health Information without authorization. The hospital has a breach, not a compliant data share.

This scenario plays out regularly — not from negligence, but from an incomplete understanding of what HIPAA’s de-identification standard actually requires.

Two Paths to De-identification — and Why Most Teams Choose Safe Harbor

HIPAA permits two methods for de-identifying protected health information: the Safe Harbor method, which requires removal of 18 specific identifiers plus confirmation of no actual knowledge of identifiability, and the Expert Determination method, where a qualified expert applies statistical analysis and concludes the re-identification risk is very small.

Safe Harbor is straightforward and prescriptive: remove the 18 identifiers and ensure no actual knowledge of identifiability remains. Expert Determination is flexible and utility-preserving but requires specialized analysis, documentation, and ongoing risk management.

For most compliance teams, Safe Harbor is the practical choice. It’s a checklist, not a judgment call. When applied correctly, the output is no longer PHI and falls outside HIPAA’s use and disclosure provisions — meaning you can share it for research, analytics, or quality improvement without patient authorization.

The problem is in the phrase “when applied correctly.” The 18 identifiers extend well beyond the obvious fields, and the places where they hide are not always obvious.

The 18 Identifiers — With the Parts Teams Most Often Miss

The identifiers that must be removed include direct identifiers, such as name, street address, and social security number, as well as other identifiers such as birth date, admission and discharge dates, and five-digit ZIP code.

Here is the complete list, organized by where compliance teams typically fail:

Routinely caught — rarely missed:

Full name, initials, aliases
Social Security Number
Phone and fax numbers
Email addresses
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate and license numbers
Device identifiers and serial numbers
URLs and IP addresses
Biometric identifiers (fingerprints, voiceprints)
Full-face photographs

Frequently missed — where breaches happen:

Dates. All elements of dates (except year) directly related to an individual must be removed, including birth date, admission, discharge, and death dates. All ages over 89 and any date elements — including year — indicative of such age must also be removed, unless grouped into a single “90 or older” category. Teams that strip names and SSNs but leave admission dates in their records have not satisfied Safe Harbor.

Geographic data. All geographic subdivisions smaller than a state must be removed, including street addresses, cities, counties, precincts, and ZIP codes. The first three digits of a ZIP code may be retained only if the geographic unit formed by combining all ZIP codes with the same initial three digits contains more than 20,000 people — otherwise, replace those digits with 000. A rural facility whose patient base spans small-population ZIP codes cannot retain even three-digit ZIP codes.

The catch-all 18th identifier. Safe Harbor requires removal of “any other unique identifying number, characteristic, or code.” This catch-all covers rare identifiers that may appear in specialized datasets — custom patient tokens in research systems, uncommon membership IDs, or any field that could uniquely identify an individual. When in doubt, remove it.

Where Identifiers Actually Hide in Documents

The checklist above addresses structured data — tables, spreadsheets, database exports. Documents present a harder problem because identifiers appear in unstructured form across every field.

Progress notes and clinical narratives. A physician’s note might reference the patient by name in the first sentence, mention a family member by name, refer to a specific street address, or describe a workplace that effectively identifies a person in a small community. Pattern matching catches email addresses and phone numbers. It misses narrative references.

Scanned PDFs with OCR layers. A scanned form has a visible image layer and, if OCR has been applied, a separate text layer. Redacting the image layer doesn’t touch the text layer. Organizations must handle unstructured content including progress notes, referral letters, scanned PDFs, and optical character recognition outputs, and should review a sample manually.

Image and file metadata. DICOM files — the standard format for medical imaging — embed patient name, date of birth, and medical record number in the file header, not in the visible image. Organizations must strip DICOM and image metadata that contain names, MRNs, or dates, and avoid full-face photos and comparable images. Sharing a DICOM file with a redacted image but intact header is sharing PHI.

Embedded documents and attachments. A PDF might contain attachments — embedded Excel sheets, Word documents, other PDFs. Each attachment is a separate data object with its own content and metadata. A redaction process that touches the visible document but not its attachments leaves identifiers intact.

File properties. The document properties of any Word or PDF file typically contain the author’s name, the name of the organization, and revision history. For clinical documents, this often means the treating physician’s name and the healthcare facility — both identifiers under Safe Harbor.

The Free Text Problem

Covered entities must remove protected health information from free text fields to satisfy the Safe Harbor method. This is one of the most commonly overlooked requirements.

Free text is where clinical documentation lives. Progress notes, referral letters, discharge summaries, and treatment plans are narrative documents, not structured records. Every sentence potentially contains PHI — and it doesn’t appear in labeled fields that automated systems can easily target.

A patient might be referred to by name three paragraphs into a clinical note. A family member’s name might appear in a social history section. A specific employer, school, or community organization might appear in a way that effectively identifies a patient in a small population.

Common pitfalls include forgetting uncommon identifiers embedded in free text, retaining highly unique combinations of attributes, or relying solely on redaction without verifying that residual data cannot single out a person.

NLP-based entity recognition handles free text better than rule-based pattern matching, but it requires tuning to clinical vocabulary and should be supplemented with manual sampling — particularly for short documents, rare conditions, and small patient populations where indirect identifiers carry higher re-identification risk.

Documentation: The Compliance Requirement Nobody Mentions

Removing the 18 identifiers is the technical requirement. Proving you removed them is the compliance requirement.

HIPAA requires organizations to substantiate de-identification decisions. For Safe Harbor, keep records that the 18 identifiers were removed and that you have no actual knowledge of residual identification risk.

Good documentation also tracks dataset versions, data lineage, and approvals, ensuring stakeholders can reconstruct what was shared, when, and under which rationale.

In practice, this means:

A written record of which identifiers were present in the source data
Documentation of which removal or generalization techniques were applied to each
Evidence that free text fields were reviewed
An attestation that no actual knowledge of residual identifiability exists
A log of what was shared, with whom, for what purpose, and when

An organization that performs perfect de-identification but maintains no documentation cannot demonstrate Safe Harbor compliance under audit. The process and the records are both required.

The Re-identification Code Exception

Safe Harbor allows one exception: a covered entity may assign a code or other means of record identification to allow de-identified information to be re-identified by the covered entity, provided the code is not derived from or related to information about the subject of the information.

In plain terms: you can maintain an internal mapping between de-identified records and their source patients, as long as the code itself doesn’t contain or encode any PHI, and you never disclose the mapping or the mechanism for re-identification to the data recipient.

This is important for longitudinal research and quality improvement work, where linking a de-identified record back to a patient may be necessary for follow-up. The mapping table must be stored separately, with strict access controls, and its existence must not be disclosed to data recipients.

The Safe Harbor Checklist

Before sharing any document or dataset externally under HIPAA Safe Harbor:

Structured data: ☐ Names removed (including relatives, employers, household members) ☐ Geographic data generalized to state level (ZIP codes handled per 20,000-person rule) ☐ Dates reduced to year only; ages over 89 aggregated to “90 or older” ☐ SSNs, MRNs, account numbers, license numbers removed ☐ Phone, fax, email, URL, IP address removed ☐ Device identifiers, vehicle identifiers removed ☐ Biometric identifiers removed ☐ Full-face photographs removed ☐ Catch-all: any other unique identifier removed ☐ Re-identification code (if used) stored separately, not derivable from PHI

Documents and free text: ☐ Narrative fields reviewed for embedded names, addresses, dates ☐ Scanned PDFs: both image and OCR layer checked ☐ DICOM and image metadata stripped ☐ Embedded attachments checked separately ☐ File metadata (author, organization, revision history) scrubbed

Documentation: ☐ Record of which identifiers were present and how they were handled ☐ Free text review documented ☐ “No actual knowledge” attestation signed ☐ Release log updated with recipient, purpose, date

PII Redaction Pro processes PDF, DOCX, TXT, CSV, and XLSX files locally on your Windows machine — automated entity detection across structured and free text fields, with permanent content removal and metadata scrubbing. No files leave your system. Try it free for 7 days.