Skip to main content
March 16, 20266 min readHealthcare

HIPAA De-identification in 2026: What's New

The HIPAA Security Rule is getting its biggest update in years. Learn about the new requirements coming in May 2026 and how to ensure your de-identification practices remain compliant.

2026 HIPAA Updates Overview

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights is finalizing significant updates to the HIPAA Security Rule in May 2026. These changes represent the most substantial revision to HIPAA security requirements since the HITECH Act of 2009.

Key Deadline

May 2026: New HIPAA Security Rule finalized. Compliance deadlines extend into late 2026.

Key Changes in the 2026 Security Rule

  • Mandatory Encryption: Encryption at rest and in transit becomes required for all ePHI—no longer "addressable."
  • Multi-Factor Authentication: MFA required for all systems accessing ePHI.
  • 24-Hour Breach Reporting: Business associates must report security incidents within 24 hours of discovery.
  • Elimination of "Addressable" Controls: The flexible approach that allowed alternative safeguards is being replaced with specific requirements.

De-identification Methods Explained

HIPAA recognizes two methods for de-identifying Protected Health Information (PHI). When properly applied, de-identified data is no longer subject to HIPAA regulations.

Expert Determination Method

A qualified statistical or scientific expert determines that the risk of re-identification is "very small." This method requires:

  • Expert with appropriate knowledge and experience
  • Application of statistical and scientific principles
  • Documentation of methods and results

Safe Harbor Method

The more commonly used approach requires removal of 18 specific identifiers. This is where automated tools like anonym.today can help ensure complete and consistent de-identification.

The 18 HIPAA Identifiers

Direct Identifiers

  1. Names
  2. Geographic data smaller than state
  3. Dates (except year) related to individual
  4. Phone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security Numbers
  8. Medical record numbers
  9. Health plan beneficiary numbers

Additional Identifiers

  1. Account numbers
  2. Certificate/license numbers
  3. Vehicle identifiers and serial numbers
  4. Device identifiers and serial numbers
  5. Web URLs
  6. IP addresses
  7. Biometric identifiers
  8. Full-face photographs
  9. Any other unique identifying number

How to Apply Safe Harbor Method

ZIP Code Handling

You may retain the first three digits of a ZIP code if the geographic unit contains more than 20,000 people. Otherwise, replace with "000."

Date Handling

All dates must be generalized to year only. For ages over 89, aggregate into a single category of "90 or older."

Automated Detection with anonym.today

anonym.today detects all 18 HIPAA identifiers automatically, plus additional healthcare-specific entities like:

  • Medical conditions and diagnoses
  • Medication names
  • Treatment codes
  • Healthcare provider names
  • Insurance information

Tools for HIPAA-Compliant Anonymization

Why anonym.today for HIPAA

  • Zero data retention: Processing is ephemeral, nothing stored
  • EU-based hosting: Germany servers, no US jurisdiction issues
  • All 18 identifiers: Complete Safe Harbor method support
  • Offline option: Desktop app for maximum security

Common De-identification Mistakes

Incomplete Removal

Missing identifiers in free-text fields, notes, or embedded metadata.

Inconsistent Application

Applying de-identification to some records but not others in a dataset.

Re-identification Risk

Leaving enough data points that could be combined to identify individuals.

Tracking Technologies

Using analytics tools that inadvertently collect PHI through URLs or identifiers.

Preparing for 2026 Compliance

With the new HIPAA Security Rule coming in May 2026, healthcare organizations should take action now:

  1. Audit current de-identification practices against the 18 identifiers
  2. Implement automated tools to ensure consistent de-identification
  3. Review business associate agreements for breach reporting requirements
  4. Prepare for mandatory encryption and MFA requirements
  5. Document all de-identification processes for compliance audits

Ensure HIPAA-Compliant De-identification

Detect all 18 HIPAA identifiers automatically with anonym.today.