# HIPAA De-Identification — Standards and References

## Primary Legal Sources
- **45 CFR §164.514(a)** — Standard: de-identification of protected health information
- **45 CFR §164.514(b)(1)** — Expert determination method
- **45 CFR §164.514(b)(2)** — Safe harbor method (18 identifiers)
- **45 CFR §164.514(c)** — Re-identification (code-based re-identification conditions)
- **45 CFR §164.514(e)** — Limited data set (definition and data use agreement requirements)

## OCR Guidance
- **OCR Guidance on De-Identification** — "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule" (November 2012, updated September 2023)
- **OCR FAQ on De-Identification** — frequently asked questions on safe harbor, expert determination, and limited datasets

## Statistical and Technical Standards
- **k-anonymity**: Sweeney L. "k-anonymity: a model for protecting privacy." International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 2002
- **l-diversity**: Machanavajjhala A, et al. "l-diversity: Privacy beyond k-anonymity." ACM TKDD, 2007
- **t-closeness**: Li N, Li T, Venkatasubramanian S. "t-closeness: Privacy beyond k-anonymity and l-diversity." IEEE ICDE, 2007
- **Differential Privacy**: Dwork C, Roth A. "The Algorithmic Foundations of Differential Privacy." Foundations and Trends in Theoretical Computer Science, 2014
- **NIST SP 800-188** — "De-Identifying Government Datasets" (December 2016) — guidance on de-identification methods

## Census Data (for Safe Harbor ZIP code validation)
- **US Census Bureau** — Population data by 3-digit ZIP code prefix for the 20,000 threshold determination
- Census Geocoder and American Community Survey data