Part 2 de-identification methods

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.16(a)(1)(i)(E) and (ii)(D) incorporate 45 CFR 164.514(b) for de-identifying paper and electronic patient-identifying information. Section 164.514(b) provides two methods: a documented qualified-expert determination that identification risk is very small, or Safe Harbor removal of specified identifiers combined with no actual knowledge that the remainder can identify the person. The HHS fact sheet identifies February 16, 2026 as the Part 2 compliance date.

Expert Determination is contextual

Under 45 CFR 164.514(b)(1), the qualified person applies accepted statistical and scientific principles, considers the anticipated recipient and reasonably available information, determines that identification risk is very small, and documents methods and results.

Safe Harbor has two conditions

Safe Harbor removes the listed identifiers of the person and relatives, employers, and household members. It also requires that the covered entity lack actual knowledge that the remaining information could identify the subject alone or with other information.

Method names do not finish the work

Part 2 applies the standard to paper and electronic records through 42 CFR 2.16. Preserve the method, data version, field treatment, free-text review, recipient, actual-knowledge assessment, expert report when used, validation, approval, and release history.

Choose the method from the data and use case

Start with data type, purpose, recipient, distribution, required utility, population, sample size, rare attributes, dates, geography, free text, images, longitudinal pattern, external linkage, repeated-release plan, and acceptable controls. Safe Harbor offers a prescriptive identifier-removal route but can remove useful detail. Expert Determination can support a context-specific design but requires qualified analysis and documented results.

Record why the selected method fits the release. Do not choose Safe Harbor because it seems faster before inventorying all identifiers, or Expert Determination simply to preserve every desired field.

Complete Safe Harbor as two conditions

Use the current regulatory list for names, geographic detail below the permitted level, date elements and ages subject to the rule, contact information, government and account identifiers, device and web identifiers, biometric identifiers, photographs and comparable images, and any other unique identifying characteristic or code. Apply the list to the person and specified connected individuals and organizations.

Then document whether the organization has actual knowledge that remaining information could identify the subject alone or combined with other information. A rare event, public story, small program, unique occupation, exact narrative, or reversible code can defeat the method even after listed fields are removed.

Require a defensible Expert Determination

Verify the expert has appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods. Define the exact data, anticipated recipient, reasonably available other information, attack or linkage pathways, methods, thresholds, transformations, controls, residual risk, limitations, and very-small-risk conclusion.

Preserve the expert's methods and results and connect the opinion to data, code, schema, recipient, and release version. Reassessment is needed when any of those conditions materially changes.

Validate the released artifact

For paper, inspect every surface, attachment, label, and copy. For electronic data, inspect fields, text, files, metadata, logs, joins, keys, code, and actual export. Test transformations, counts, suppressed values, rare combinations, recipient access, and repeat-release linkage.

Keep source data, mapping keys, rejected versions, and transformation environments restricted. Record method owner, reviewer, approval, release, recipient, purpose, retention, incident contact, and change trigger.

Pause when neither method is complete

If Safe Harbor would leave a listed identifier, actual knowledge creates identification risk, the expert's qualifications or documentation are incomplete, or the release differs from the assessed version, stop the release. Consider a smaller data set, broader categories, stronger suppression, a controlled query, a qualified expert review, or an identified-data route with separate authority.

Record the decision and unresolved risk. Operational urgency, research value, contractual demand, or a recipient's promise not to identify patients does not finish a missing regulatory element.

Example

Twelve data releases reach review. Five use current expert reports, four meet the complete Safe Harbor checklist, and three merely remove names. Method-complete readiness is 9 of 12 releases.

Method-selection checklist

• inventory the complete paper or electronic data and anticipated context;
• compare Safe Harbor utility and completeness with Expert Determination needs;
• satisfy both Safe Harbor identifier removal and no-actual-knowledge conditions;
• verify expert qualifications and preserve methods, results, limits, and versions;
• validate the exact artifact, external linkage, rare facts, and repeated releases; and
• reassess after data, code, schema, recipient, purpose, or external-context change.

A method label is not evidence. The organization should be able to show how the exact released data satisfied every element of the selected route.