HIPAA De-identification in 2026: What's New
The HIPAA Security Rule is getting its biggest update in years. Learn about the new requirements coming in May 2026 and how to ensure your de-identification practices remain compliant.
2026 HIPAA Updates Overview
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights is finalizing significant updates to the HIPAA Security Rule in May 2026. These changes represent the most substantial revision to HIPAA security requirements since the HITECH Act of 2009.
Key Deadline
May 2026: New HIPAA Security Rule finalized. Compliance deadlines extend into late 2026.
Key Changes in the 2026 Security Rule
- Mandatory Encryption: Encryption at rest and in transit becomes required for all ePHI—no longer "addressable."
- Multi-Factor Authentication: MFA required for all systems accessing ePHI.
- 24-Hour Breach Reporting: Business associates must report security incidents within 24 hours of discovery.
- Elimination of "Addressable" Controls: The flexible approach that allowed alternative safeguards is being replaced with specific requirements.
De-identification Methods Explained
HIPAA recognizes two methods for de-identifying Protected Health Information (PHI). When properly applied, de-identified data is no longer subject to HIPAA regulations.
Expert Determination Method
A qualified statistical or scientific expert determines that the risk of re-identification is "very small." This method requires:
- Expert with appropriate knowledge and experience
- Application of statistical and scientific principles
- Documentation of methods and results
Safe Harbor Method
The more commonly used approach requires removal of 18 specific identifiers. This is where automated tools like anonym.today can help ensure complete and consistent de-identification.
The 18 HIPAA Identifiers
Direct Identifiers
- Names
- Geographic data smaller than state
- Dates (except year) related to individual
- Phone numbers
- Fax numbers
- Email addresses
- Social Security Numbers
- Medical record numbers
- Health plan beneficiary numbers
Additional Identifiers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers
- Full-face photographs
- Any other unique identifying number
How to Apply Safe Harbor Method
ZIP Code Handling
You may retain the first three digits of a ZIP code if the geographic unit contains more than 20,000 people. Otherwise, replace with "000."
Date Handling
All dates must be generalized to year only. For ages over 89, aggregate into a single category of "90 or older."
Automated Detection with anonym.today
anonym.today detects all 18 HIPAA identifiers automatically, plus additional healthcare-specific entities like:
- Medical conditions and diagnoses
- Medication names
- Treatment codes
- Healthcare provider names
- Insurance information
Tools for HIPAA-Compliant Anonymization
Why anonym.today for HIPAA
- • Zero data retention: Processing is ephemeral, nothing stored
- • EU-based hosting: Germany servers, no US jurisdiction issues
- • All 18 identifiers: Complete Safe Harbor method support
- • Offline option: Desktop app for maximum security
Common De-identification Mistakes
Incomplete Removal
Missing identifiers in free-text fields, notes, or embedded metadata.
Inconsistent Application
Applying de-identification to some records but not others in a dataset.
Re-identification Risk
Leaving enough data points that could be combined to identify individuals.
Tracking Technologies
Using analytics tools that inadvertently collect PHI through URLs or identifiers.
Preparing for 2026 Compliance
With the new HIPAA Security Rule coming in May 2026, healthcare organizations should take action now:
- Audit current de-identification practices against the 18 identifiers
- Implement automated tools to ensure consistent de-identification
- Review business associate agreements for breach reporting requirements
- Prepare for mandatory encryption and MFA requirements
- Document all de-identification processes for compliance audits
Ensure HIPAA-Compliant De-identification
Detect all 18 HIPAA identifiers automatically with anonym.today.