Safe Harbor vs Expert Determination comes down to who decides. Under Safe Harbor, you remove a fixed list of 18 identifiers and have no actual knowledge that the rest identifies anyone. Under Expert Determination, a qualified person applies statistical methods, finds the re-identification risk very small, and documents why. Safe Harbor fits most document sets unless the work needs dates.
Safe Harbor vs Expert Determination side by side
Safe Harbor and Expert Determination are the two methods HIPAA offers for showing that health information is de-identified. Both appear in paragraph (b) of 45 CFR 164.514 on the eCFR. Safe Harbor is a checklist your own team can follow. Expert Determination is a judgment made by a person with statistical expertise about one data set and its recipients.
The table compares them on the points that matter for document data. The "typical use" column uses fictional examples.
| Point | Safe Harbor, 164.514(b)(2) | Expert Determination, 164.514(b)(1) |
|---|---|---|
| Who decides | The covered entity, by following the list | "A person with appropriate knowledge of and experience with" statistical and scientific methods |
| What is removed | All 18 listed identifiers of the patient and of relatives, employers or household members | Whatever the expert finds necessary to bring the risk down |
| Dates that survive | The year only; ages over 89 become "90 or older" | Whatever the expert's analysis supports, such as a month or a shifted date |
| ZIP digits that survive | The first three, only where that area holds more than 20,000 people | Whatever the analysis supports |
| Extra condition | No actual knowledge that the rest could identify someone | The risk is "very small" for "an anticipated recipient" |
| Documentation | The rule names none for the method itself; most teams keep a record of the steps | The expert "documents the methods and results of the analysis" |
| What it costs | Staff time to find and remove identifiers | Staff time plus the expert's fee |
| Typical use for EOB, claim and lab data | A fictional training set of EOBs with names, member IDs and service dates stripped to the year | A fictional claims extract that keeps service month and three-digit ZIP for a cost study |
The practical difference is predictability. Safe Harbor gives the same answer every time for the same document. Expert Determination depends on the data, the recipient and the expert, and it can permit fields Safe Harbor forbids. The full list of what Safe Harbor removes is in the 18 HIPAA identifiers in one list.
Choosing a method for a document project
Three questions settle most document projects. First, does the purpose need month and day, or a location finer than three ZIP digits? If not, Safe Harbor usually fits, because nothing it removes is needed. A set of sample EOBs used to test how software reads columns rarely needs a real service date.
Second, who receives the output, and can you describe them? Expert Determination is judged against "an anticipated recipient". A single research partner with a defined project is easy to describe. A file posted for anyone to download is not, and the expert will usually be more cautious about it.
Third, how much free text and imagery do the documents hold? Safe Harbor's list is easy to apply to labeled fields and hard to apply to handwritten notes, comments and scanned photos. Either method needs someone to read the free text. Expert Determination does not remove that work; it changes what you may keep once the work is done.
The choice is made per data set, not once for the whole organization. A team might use Safe Harbor for a broad sample set and commission an Expert Determination only for the one analysis that needs dates.
When is PHI considered de-identified under HIPAA?
PHI is considered de-identified under HIPAA only if it meets the standard in 45 CFR 164.514(a) by one of the two methods in 164.514(b). The standard describes information that "does not identify an individual" and where "there is no reasonable basis to believe that the information can be used to identify an individual".
Paragraph (b) then names the only two ways to get there. Its opening line says a covered entity "may determine that health information is not individually identifiable health information only if" one of the two methods is met. There is no third route, such as removing names and calling the rest anonymous.
The payoff for meeting the standard is in 45 CFR 164.502 on the eCFR. Paragraph (d)(2) says information de-identified under 164.514(a) and (b) "is considered not to be individually identifiable health information", and that the Privacy Rule's requirements "do not apply" to it. In plain terms, HIPAA de-identified information stops being PHI.
Two limits come with that. Paragraph (d)(2)(i) of 164.502 says disclosing a code "designed to enable coded or otherwise de-identified information to be re-identified constitutes disclosure of protected health information". And the source documents stay PHI. The preamble to the 2000 Privacy Rule notes that de-identification "creates a new dataset in addition to the source dataset" and "does not substitute for actual destruction of the source data". You can read that in the 2000 Privacy Rule preamble in the Federal Register.
The work of producing a de-identified copy of a document set is its own process. The post on PHI de-identification in five steps for a document set walks through it from choosing a method to release.
What does an Expert Determination engagement involve?
An Expert Determination engagement asks a person with statistical and scientific expertise to study a specific data set and its intended recipients, decide whether the re-identification risk is very small, and write down the methods and results. The regulation, 45 CFR 164.514(b)(1), sets those two duties and no others.
Who qualifies as the expert
The rule describes the expert by knowledge, not by title. It asks for "a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable". The regulation text names no license, degree or certificate. Ask a candidate to show prior de-identification work and the methods they use.
What the expert looks at
The risk is judged for "an anticipated recipient", using the information "alone or in combination with other reasonably available information". So the same claims extract can pass for one recipient and fail for another. Tell the expert who will receive the data, what they could link it with, and what they will do with it.
The 2000 Privacy Rule preamble in the Federal Register pointed to federal statistical guidance and summarized two main sources of risk: records with "very unique characteristics" and "external sources of records with matching data elements". It also listed techniques an expert may consider, such as "recoding variables into fewer categories", setting top-codes and bottom-codes, adding noise, and "limiting the distribution of the records through a 'data use agreement'".
What the expert delivers
The deliverable is documentation. The rule requires that the expert "documents the methods and results of the analysis that justify such determination". In practice, that is a written report naming the data set, the fields kept and transformed, the recipients assumed, the methods used and the conclusion. Keep it with your de-identification records.
How long it lasts
The regulation text sets no expiry date. Because the analysis is tied to an anticipated recipient and to "reasonably available information", a change in either can undercut it. Ask the expert to state the conditions the determination depends on, so you know when to ask again.
The actual knowledge clause in Safe Harbor
The actual knowledge clause is the second half of Safe Harbor. Under 45 CFR 164.514(b)(2)(ii), removing all 18 identifiers works only if the covered entity "does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual". Knowing that a record still points to a person defeats the method.
The 2000 Privacy Rule preamble in the Federal Register explains why the standard is knowledge and not suspicion. The proposed rule used "no reason to believe". The final rule changed it "to one of actual knowledge in order to provide greater certainty to covered entities using the safe harbor approach".
A fictional example shows how the clause bites. A clinic strips every listed identifier from a set of lab reports. One remaining record shows a rare test result for a patient whose job title appears in a free-text comment, and the clinic knows that only one person in its town holds that job. The list is clear, but the clinic knows the record points to one person.
Free text is where this most often happens. Comments, diagnosis descriptions and occupation fields are not on the list, so a checklist will not flag them. A reviewer who reads them and recognizes a person now has actual knowledge, and the record needs more work or a different method.
When Safe Harbor strips too much from billing and lab data
Safe Harbor strips too much when the analysis depends on the exact fields the list removes. For billing and lab data, that usually means dates and geography. A Safe Harbor copy keeps only the year of a date and, at most, three ZIP digits, which breaks timing and location studies.
Billing work is full of date arithmetic. Days from service to payment, the gap between a claim and its denial, and timely filing checks all need month and day. Under 164.514(b)(2)(i)(C), "all elements of dates (except year)" go. A fictional EOB with a service date of 03/14/2026 and a paid date of 04/02/2026 becomes two entries for 2026, and the 19-day gap is gone.
Lab data has the same problem. Trends across repeated tests depend on collection dates. A fictional series of three glucose panels drawn in January, March and June collapses into three results in one year. If your team turns lab reports into fields, as described in the guide to lab report data extraction, you will feel that loss when you try to line results up over time.
Geography matters for network and access questions. Three ZIP digits may be too coarse to compare clinics in one city, and the rule replaces small areas with "000".
When these losses defeat the purpose, there are two other routes. Expert Determination can approve shifted dates or a month field for a named recipient. A limited data set keeps dates and city under a data use agreement, but it is still PHI. The comparison is in limited data set vs de-identified data at a glance.
For trying extraction on documents before any agreement is signed, Schema Care's compliance section states that it won't accept real patient data until a BAA is signed, so de-identified samples are where testing starts.