The 18 HIPAA identifiers are the items the Safe Harbor method in 45 CFR 164.514(b)(2) says must be removed before health information counts as de-identified: names, small geographic units, dates, contact numbers, record and account numbers, device and vehicle IDs, web and IP addresses, biometrics, full-face photos and any other unique code, mostly in page headers and ID boxes.
The 18 HIPAA identifiers in one list
The 18 HIPAA identifiers are listed, letter by letter, in paragraph (b)(2)(i) of 45 CFR 164.514 on the eCFR. The rule applies them to "the individual or of relatives, employers, or household members of the individual", so a spouse's name on a claim counts as much as the patient's own.
Here is the list in the regulation's own words, with its letters kept. The exception clauses in (B) and (C) are shortened here and explained in the dates and ZIP codes section:
- (A) Names
- (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, with a three-digit ZIP exception covered below
- (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89, with an exception covered below
- (D) Telephone numbers
- (E) Fax numbers
- (F) Electronic mail addresses
- (G) Social security numbers
- (H) Medical record numbers
- (I) Health plan beneficiary numbers
- (J) Account numbers
- (K) Certificate/license numbers
- (L) Vehicle identifiers and serial numbers, including license plate numbers
- (M) Device identifiers and serial numbers
- (N) Web Universal Resource Locators (URLs)
- (O) Internet Protocol (IP) address numbers
- (P) Biometric identifiers, including finger and voice prints
- (Q) Full face photographic images and any comparable images
- (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section
Removing the list is only half of Safe Harbor. Paragraph (b)(2)(ii) adds that the covered entity must not have "actual knowledge that the information could be used alone or in combination with other information to identify an individual". Safe Harbor is also only one of two methods. How it compares with the statistical route is laid out in the post on Safe Harbor vs Expert Determination side by side.
Where do the 18 identifiers appear on an EOB, claim or lab report?
The 18 identifiers appear in predictable places on medical paperwork: the header and address block of an explanation of benefits (EOB), the patient and insured boxes of a CMS-1500 claim, and the demographic band at the top of a lab report, usually before the first service line or result.
The CMS-1500 is the easiest to map, because each box has a defined job. The NUCC 1500 Claim Form Reference Instruction Manual says Item 1a holds the insured's ID number "as shown on insured's ID card", Item 2 the patient's name, Item 3 the patient's 8-digit birth date, Item 5 the patient's street address, city, state and ZIP code, and Item 26 the patient's account number "assigned by the provider of service's or supplier's accounting system".
EOBs and lab reports have no single standard layout, so the table below uses fictional documents. Every name, number and date in it is an example invented for this post.
| Identifier | Fictional EOB | Fictional CMS-1500 | Fictional lab report |
|---|---|---|---|
| (A) Names | Patient "Dana Ruiz", subscriber "Luis Ruiz" | Item 2 patient, Item 4 insured | Patient name in the header |
| (B) Geography | Mailing address "48 Elm St, Fairview" | Items 5 and 7 addresses | Patient address line |
| (C) Dates | Service date 03/14/2026 | Item 3 birth date, Item 24A service dates | Collection date, DOB |
| (D) Telephone | Member services line is the plan's, not the patient's | Rare; NUCC recommends leaving it off Item 5 | Patient phone on some reports |
| (E) Fax | Fax header on a faxed copy | Fax header on a faxed copy | Fax header on a faxed copy |
| (F) Email | Rare on paper | Rare on paper | Patient portal email on some reports |
| (G) SSN | Rare | Rare | Rare |
| (H) Medical record number | Rare | No box of its own | "MRN 0048213" |
| (I) Health plan beneficiary number | Member ID "XQZ123456789" | Item 1a insured's ID | Insurance ID line |
| (J) Account numbers | Patient account "A-20931" | Item 26 account number | Billing account number |
| (K) Certificate/license numbers | Rare | Rare | Rare |
| (L) Vehicle identifiers | Rare | Rare | Rare |
| (M) Device identifiers | Rare | Rare | Rare |
| (N) URLs | Personal portal link | Rare | Result portal link with a token |
| (O) IP addresses | Rare on paper | Rare on paper | Rare on paper |
| (P) Biometrics | None | None | None |
| (Q) Full-face photos | None | None | None |
| (R) Other unique codes | Payer claim number "2026-0314-7781" | Item 22 original reference number | Specimen or accession number |
Two patterns stand out. First, most identifiers cluster in the top third of each page. Second, the claim and EOB numbers in row (R) are easy to forget because they look like routine billing data. Claims-side layouts are covered in more depth across the claims and medical bills category.
Dates and ZIP codes: the identifiers with exceptions
Dates and ZIP codes are the two HIPAA identifiers that Safe Harbor does not require you to remove entirely. Under 45 CFR 164.514(b)(2)(i)(B) and (C), the year of a date may stay, and the first three digits of a ZIP code may stay when the area they describe holds more than 20,000 people.
The date rule reads "All elements of dates (except year) for dates directly related to an individual". On a fictional EOB with a service date of 03/14/2026, only "2026" may remain. The same applies to a birth date, an admission date, a discharge date and a date of death.
Ages have their own clause. The rule removes "all ages over 89 and all elements of dates (including year) indicative of such age", and then allows them to be "aggregated into a single category of age 90 or older". So a fictional patient born in 1931 cannot keep the birth year on a 2026 document. The record can say "90 or older" instead.
The ZIP code exception has two conditions. The three-digit area formed by "combining all zip codes with the same three initial digits" must contain "more than 20,000 people" according to "the current publicly available data from the Bureau of the Census". For areas of 20,000 or fewer people, the initial three digits are "changed to 000". A fictional ZIP of 59301 could become 593 only if that three-digit area passes the population test on current Census data. Check the current figures each time, because the rule ties the test to current data, not to a fixed list.
Is a claim number or member ID one of the HIPAA identifiers?
A member ID is one of the HIPAA identifiers: it falls under (I), "Health plan beneficiary numbers". A patient account number falls under (J), "Account numbers", and a chart number under (H), "Medical record numbers". A payer's claim number is not named in the list, but it belongs under (R) as "any other unique identifying number".
Row (R) is the catch-all that trips people up. A claim number, an accession number on a lab specimen, a prior authorization number and an EOB check number can each point back to one patient's record in someone's system. The regulation does not list them by name, yet it covers "any other unique identifying number, characteristic, or code".
The one exception to row (R) is a code the covered entity creates for re-identification under paragraph (c). The rule allows it only when the code "is not derived from or related to information about the individual" and is not used or disclosed for any other purpose. A truncated member ID or the last four digits of an account number is derived from information about the person, which the derivation condition rules out. How re-identification codes and pseudonyms fit alongside limited data sets is the subject of limited data set vs de-identified data.
Identifiers hiding in barcodes, fax headers and handwriting
Identifiers outside labeled fields are the ones a team most often misses when it de-identifies medical paperwork. Barcodes, fax transmission headers, handwritten notes in margins, stamps and file names can each carry a name, a date, a phone number or an account number that no box on the form was meant to hold.
Fax headers are the most common example. The line printed across the top of a faxed page often shows the sending fax number, a date and time, and sometimes the sender's name. That is (E), (C) and possibly (A) in one strip of text, on a page whose form fields may be clean.
Barcodes and QR codes are harder, because a person cannot read them by eye. A specimen label or a mailing barcode can encode an accession number, a member ID or an address. Treat any machine-readable code as a possible identifier until you know what it holds.
Handwriting is the third gap. Staff write callback numbers, patient initials and dates of birth in margins, on sticky notes that get scanned, and across the back of a page. Field-based tools that read only the printed form will skip these entirely.
File names and document metadata count too, since they travel with the scan. A PDF named "Ruiz_Dana_DOB_1958-07-02.pdf" leaks two identifiers before anyone opens it. Removing identifiers from the visible page does not clean the text layer or the metadata. The method for that is in redacting PHI from PDFs step by step.
For working through a whole document set, from choosing a method to testing the output, follow the PHI de-identification guide. If you want to test document extraction before any real patient data is involved, Schema Care's free plan is for trying it on de-identified sample documents.