PHI de-identification for a set of medical documents takes five steps: choose Safe Harbor or Expert Determination, find every identifier in fields, free text and images, remove them from the page and the file, check a sample for misses, and keep a record of the method and the checks. The output is a new copy; the originals stay PHI.
PHI de-identification in five steps for a document set
PHI de-identification for a document set is the work of turning scanned EOBs, claims, lab reports and intake forms into copies that meet HIPAA's de-identification standard in 45 CFR 164.514 on the eCFR. The five steps below run from choosing a method to releasing the copy, and each produces a record you keep.
Step 1: Choose the method and write down why
Pick Safe Harbor, which removes a fixed list of identifiers, or Expert Determination, where a statistical expert judges the risk. Record the purpose of the copy, who will receive it, and which fields the purpose needs. If the work needs month and day, Safe Harbor will not keep them. The trade-offs are laid out in Safe Harbor vs Expert Determination side by side.
Step 2: Inventory where identifiers sit
List each document type in the set and mark where identifiers appear: header blocks, address lines, member ID boxes, account numbers, dates, signatures, fax headers, barcodes and margins. Under Safe Harbor, the list to check against is the one in the 18 HIPAA identifiers in one list. Remember that it covers relatives, employers and household members too, so a subscriber's name on a dependent's EOB counts.
Step 3: Remove identifiers from the page and the file
Remove or replace each identifier in the image, the text layer and the file metadata. A black box drawn over a PDF can leave the text underneath readable, and file names often carry a patient's name. The technique is in redacting PHI from PDFs step by step. If you need to link records later, assign a code that meets the re-identification rule in 164.514(c), covered under is pseudonymized data de-identified under HIPAA.
Step 4: Check a sample for missed identifiers
Have someone who did not do the removal read a sample of the output page by page and log every identifier found. A failed page sends its batch back to step 3. The sampling method is in the next sections of this guide.
Step 5: Release the copy and file the record
Release the copy only to the recipient named in step 1. File the method, the inventory, the QA log and, for Expert Determination, the expert's report together. Keep the originals under your normal PHI controls, because the 2000 Privacy Rule preamble says de-identification "does not substitute for actual destruction of the source data", as you can read in the 2000 Privacy Rule preamble in the Federal Register.
A worked example with fictional documents
A fictional billing team wants 200 EOBs and 50 lab reports to test how software reads service lines. Every name and number here is invented for the example.
In step 1, the team picks Safe Harbor, because the test needs amounts and codes, not real dates. The record says: purpose, software test; recipient, the internal test team; fields needed, service lines, amounts, remark codes.
In step 2, the inventory finds the patient and subscriber names, mailing address, member ID "XQZ123456789", payer claim number, service dates and check number on each EOB. The lab reports add a medical record number, an accession number, a collection date and, on 12 of them, a fax header.
In step 3, staff replace names with "Patient A" and "Subscriber A", cut addresses, swap member and claim numbers for random codes from a table they keep, reduce dates to "2026", and strip fax headers, text layers and file names.
In step 4, a second reviewer samples 25 EOBs and 10 lab reports. One lab report still shows a handwritten callback number, so that batch of 25 goes back to step 3 and is sampled again.
In step 5, the copy goes to the test team, and the method note, inventory, QA log and code table location are filed together.
Who should perform PHI de-identification?
PHI de-identification can be performed by the covered entity's own staff, by a vendor working under a business associate agreement, or, for Expert Determination, by a qualified expert. HIPAA allows all three. The choice depends on volume, on how much free text the documents hold, and on which method you chose.
In-house staff
Safe Harbor suits in-house work. The 2000 Privacy Rule preamble in the Federal Register describes it as an "easily followed, cook book approach", and the covered entity applies the list itself. In-house work keeps the documents inside your existing PHI controls. The cost is staff time, and the risk is fatigue on long, repetitive batches.
A vendor under a BAA
A vendor can do the work, but it handles PHI to do so. 45 CFR 164.502 on the eCFR, paragraph (d)(1), says a covered entity may "disclose protected health information only to a business associate" for the purpose of creating de-identified information. In other words, the vendor that strips identifiers needs to be a business associate under contract before it sees the originals.
An expert, for Expert Determination
Expert Determination needs a person with statistical and scientific expertise, as 164.514(b)(1) describes, who decides what may stay and documents why. Who qualifies and what the report contains are covered in what an Expert Determination engagement involves. The expert does not have to do the redaction; staff or a vendor can carry out the expert's instructions.
These roles can be combined. A team might have staff remove labeled fields, a vendor under a BAA handle a large backlog, and a second person run the QA check in step 4.
How do you check that de-identified PHI stays de-identified?
You check de-identified PHI by sampling the output and reading each sampled page for anything that still identifies a person: listed identifiers, free-text clues and machine-readable codes. A second reviewer who did not do the removal should read the sample and log what they find, page by page.
Sampling
Draw the sample from every document type and every batch, including the last one. Take more pages from types with free text, such as discharge summaries and intake forms, than from tightly structured ones. Any page with a find fails its batch, and the batch goes back for rework and a fresh sample.
What the reviewer reads
Read the image, then the text layer, then the file name and metadata. Search the text layer for patterns such as dates, phone numbers and long digit strings. Scan any barcode or QR code with a reader to see what it holds. Read every comment and handwritten note in full.
The QA sampling log
Keep one row per page sampled. The values below are fictional examples.
| Document ID | Document type | Identifiers found | Reviewer | Date | Pass or fail |
|---|---|---|---|---|---|
| DOC-0412 | EOB | None | J. Park | 2026-10-05 | Pass |
| DOC-0417 | Lab report | Fax header with sending number and date | J. Park | 2026-10-05 | Fail |
| DOC-0533 | Intake form | Handwritten callback number in margin | M. Osei | 2026-10-06 | Fail |
| DOC-0601 | CMS-1500 | None | M. Osei | 2026-10-06 | Pass |
Staying de-identified over time
A copy that passed can stop meeting the standard. Under Safe Harbor, learning that a record still points to a person is actual knowledge under 164.514(b)(2)(ii). Under Expert Determination, the risk was judged for "an anticipated recipient", so a new recipient or a newly available data source is a reason to ask the expert again. A re-identification code shared outside the covered entity also counts as disclosing PHI under 164.502(d)(2)(i).
Documenting PHI de-identification for an audit
Documenting PHI de-identification means keeping the records that show which method you used, what you removed, how you checked, and who did the work. For Expert Determination, the rule itself requires documentation: under 164.514(b)(1)(ii), the expert "documents the methods and results of the analysis that justify such determination".
HIPAA's general documentation rule sets how long such records stay. 45 CFR 164.530 on the eCFR, paragraph (j)(1)(iii), says that when "an action, activity, or designation is required by this subpart to be documented", the covered entity must "maintain a written or electronic record". Paragraph (j)(2) sets retention at "six years from the date of its creation or the date when it last was in effect, whichever is later".
Safe Harbor has no matching documentation clause in 164.514(b)(2). A record is still the only way to show later that the list was applied. A practical file for each release holds:
- The purpose, the recipient and the method chosen, with the reason (step 1)
- The identifier inventory by document type (step 2)
- The removal procedure, the tools used and the operators (step 3)
- The QA sampling log, failed batches and rework (step 4)
- For Expert Determination, the expert's report and any conditions it sets
- For any re-identification code, how it was generated and who holds the key
- The release date and the recipient's acknowledgment (step 5)
Schema Care keeps a similar trail for extraction work: each reviewer approval and correction is logged with who made it and when, the same who-and-when detail this file keeps for de-identification.
Free text and images: where PHI de-identification fails
PHI de-identification most often fails in free text and images, because field-based tools only clean the boxes they know about. Clinical notes, comment lines, handwritten margins, stamps, photos and barcodes can each carry a name, a date or a number that no labeled field was designed to hold.
Free text is the hardest part. A discharge summary can mention a relative by name, an employer, a town or a date of admission in running prose. Software that reads clinical narrative, the subject of clinical document extraction, can help find these, but a person should still read what it flags and what it does not.
Indirect clues are the next problem. A job title, a rare condition described in a comment, or a reference to a local event can point to one person even after every listed identifier is gone. Under Safe Harbor, a reviewer who recognizes the person now has actual knowledge, and the record needs more work.
Images defeat text-based tools entirely. Scanned insurance cards, photo IDs, wound photos and signatures stay in the image unless someone removes them from the pixels. Barcodes and QR codes need a reader to reveal what they encode.
Finally, check what travels with the file: the text layer, PDF metadata, file names and any embedded attachments. Each one can undo careful work on the visible page. When the output needs to keep dates for analysis, consider a limited data set under a data use agreement instead; the trade-offs are in limited data set vs de-identified data.