Guide

De-identification and patient stories: the 18 identifiers and the composite-case answer

Summary

Yes, but only if the story is genuinely de-identified or the patient signed a HIPAA authorization. De-identification means stripping all 18 Safe Harbor identifiers and having no reason to believe the person is still identifiable, or obtaining an expert determination. For teaching and writing, a fictionalized composite drawn from several patients is the safest route; a single recognizable case still needs written authorization even when names are removed. Professional ethics rules apply on top of HIPAA.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

Is a de-identified story still protected health information?

A story that has been properly de-identified is no longer protected health information, and the Privacy Rule places no restriction on its use or disclosure 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule governs use and disclosure of PHI and does not restrict use or disclosure of information once it has been de-identified.. Once information cannot reasonably identify the patient, HIPAA stops applying to it. But de-identification is a legal term with a precise test, not a judgment call: changing a name while leaving the diagnosis, the date, and the small town intact meets neither method the rule allows 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative de-identification standard in Part 164 — the Safe Harbor list of identifiers and the expert-determination method..

Two lawful methods, no third. De-identification under 45 CFR 164.514 is either the Safe Harbor method — remove a fixed list of identifiers and hold no actual knowledge that the remainder could identify the person — or Expert Determination, where a qualified person certifies that the re-identification risk is very small 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative de-identification standard in Part 164 — the Safe Harbor list of identifiers and the expert-determination method.. Whether HIPAA reaches you at all is a separate question answered by the covered-entity test; this page assumes it does.

The 18 identifiers Safe Harbor requires you to remove

The Safe Harbor method requires removing eighteen categories of identifiers from the record — and not only the patient's own, but those of relatives, employers, and household members 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative de-identification standard in Part 164 — the Safe Harbor list of identifiers and the expert-determination method.. Miss one and the story is still PHI. The list is exact, so treat it as a checklist you run against every case before it leaves your office.

#	Identifier	Practical trap
1	Names	Nicknames and initials count
2	Geography below state	Street, city, county, precinct, most ZIP codes
3	Dates tied to the individual	Birth, admission, discharge, death; ages over 89
4-6	Phone, fax, email	Including a partial number
7-9	SSN, MRN, health-plan number	Any fragment
10-11	Account, certificate, license numbers	Professional license of a family member too
12-13	Vehicle and device identifiers	Plates, serial numbers
14-15	URLs and IP addresses	A patient's social handle
16	Biometric identifiers	Voice, fingerprints
17	Full-face photographs	And comparable images
18	Any other unique code or characteristic	The rare-diagnosis-in-a-small-town problem

Item 18 is where clinicians get caught: a genuinely unusual presentation, an occupation held by one person in a region, or a widely reported local event can identify a patient even after every named field is gone.

The composite case: why fiction beats redaction

For teaching and writing, the safest route is a fictionalized composite — a case built from clinical patterns drawn across several patients rather than one real person with the labels filed off. A common convention among clinician-writers is to combine details from multiple cases, alter non-clinical specifics, and state plainly in the text that the case is a composite. Because no single individual is being described, there is no one to re-identify.

Why redaction alone is fragile. Deleting the name from a single true case leaves the narrative arc, the timeline, and the incidental details that make a story worth telling — and those details are exactly what identify the person to anyone who knows them. The composite breaks that chain at the source. Keep the clinical teaching point; invent the surrounding facts. If you must present one real case, de-identify to the Safe Harbor standard and treat item 18 as the hardest line to clear.

When you still need a signed authorization

If the material is identifiable and the use is anything other than treatment, payment, or operations, you need a HIPAA authorization signed by the patient — and if the purpose is promotional, the marketing rules apply and authorization is required with narrow exceptions 3Ref 3HHS Office for Civil Rights (2026).Marketing.That using identifiable PHI for promotional purposes requires a signed authorization, with narrow exceptions.. A conference case where colleagues could recognize the patient, a book that reproduces recognizable detail, photos and testimonials on a practice website: each of these is a use that de-identification would have avoided, so if you keep the identifying detail you need consent in writing first.

Get the authorization before you write, not after. An authorization obtained after publication does not cure the disclosure that already happened. The document should name what will be disclosed, to whom, for what purpose, and the patient's right to revoke. For a vulnerable or formerly-treating relationship, weigh whether asking at all creates pressure the patient cannot freely decline.

Expert determination: the other lawful path

Expert determination is the second lawful method and it exists for exactly the case Safe Harbor handles badly — data you need to keep partially intact, such as dates or geography, for the work to make sense 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The operative de-identification standard in Part 164 — the Safe Harbor list of identifiers and the expert-determination method.. A person with appropriate statistical and scientific knowledge applies accepted methods, determines the re-identification risk is very small, and documents that determination. It is rarely worth the cost for a single case vignette, but it is the right tool for a dataset, a research write-up, or a quality-improvement report where stripping every date would destroy the analysis.

For most solo-practice teaching and writing, you will never need this route. Reach for it only when the composite or Safe Harbor path cannot preserve the detail the work genuinely requires, and budget for a qualified determiner rather than certifying your own data.

What OCR enforces, and the ethics rules on top

The Office for Civil Rights enforces the Privacy Rule through complaint investigations, compliance reviews, and civil money penalties, and its published actions include very small practices — a solo clinician is not too small to be investigated 4Ref 4HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces the Privacy Rule through investigations, compliance reviews, and civil money penalties, including against very small practices.. A recognizable case posted without authorization is the kind of disclosure a patient can complain about directly, and OCR maintains the guidance and complaint process a patient would use 5Ref 5HHS Office for Civil Rights (2026).HIPAA for Professionals.The OCR hub for privacy guidance and the individual complaint process..

Ethics sits on top of HIPAA, not underneath it. Your licensing board and professional association typically expect informed consent for using clinical material in publication or teaching even where HIPAA would permit a de-identified use — the two frameworks are additive. Clear the legal standard, then clear the ethical one: is the patient identifiable to themselves or their circle, would they object, and does the teaching value justify the use? When the answer is uncertain, build a composite instead.

Common questions

No. Safe Harbor requires removing all eighteen identifier categories, and a story stripped of a name can still be identifiable through the diagnosis, the timeline, the location, or a unique circumstance. The eighteenth category — any other unique identifying characteristic — catches the rare presentation in a small community. A composite drawn from several patients is more reliable than redacting one real case.

Only if the presentation is genuinely de-identified to the Safe Harbor standard, or the patient signed an authorization. Colleagues who share a referral network can sometimes recognize a patient from clinical detail alone. If recognizable detail is essential to the teaching point, obtain written authorization first; otherwise, fictionalize the surrounding facts into a composite that carries the same lesson.

Under HIPAA, no — properly de-identified information is not protected health information and needs no authorization. But your licensing board and professional ethics code may still expect informed consent for clinical case material, and those obligations are separate from HIPAA. Clear both: de-identify to the legal standard, then apply the ethical test your board and profession set.

Safe Harbor is a mechanical checklist: remove the eighteen identifier categories and hold no actual knowledge that the remainder identifies anyone. Expert determination lets a qualified person certify that the re-identification risk is very small while keeping some detail — useful for datasets or research where stripping every date would break the analysis. For a single teaching vignette, Safe Harbor or a composite is usually enough.

No. Using identifiable material to promote your practice is marketing under HIPAA and requires a signed authorization, not a verbal okay. A photo is itself an identifier, and a testimonial names the person. Get written authorization that states the use and the right to revoke before anything is posted, and remember that an after-the-fact signature does not cure a disclosure already made.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat the Privacy Rule governs use and disclosure of PHI and does not restrict use or disclosure of information once it has been de-identified.
2.Office of the Federal Register (2026). 45 CFR Part 164 — Security and Privacy. eCFR. link ✓The operative de-identification standard in Part 164 — the Safe Harbor list of identifiers and the expert-determination method.
3.HHS Office for Civil Rights (2026). Marketing. U.S. Department of Health and Human Services. linkThat using identifiable PHI for promotional purposes requires a signed authorization, with narrow exceptions.
4.HHS Office for Civil Rights (2026). HIPAA Compliance and Enforcement. U.S. Department of Health and Human Services. linkThat OCR enforces the Privacy Rule through investigations, compliance reviews, and civil money penalties, including against very small practices.
5.HHS Office for Civil Rights (2026). HIPAA for Professionals. U.S. Department of Health and Human Services. linkThe OCR hub for privacy guidance and the individual complaint process.

https://www.gale.care/for-providers/hip-deidentification-case-material · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers