HHS OCR guidance on de-identification (2012): hashed codes (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.5)
A plain hash of a patient identifier is itself an identifier under Safe Harbor; only a keyed code that meets paragraph (c) may stay.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“For instance, a code derived from a secure hash function without a secret key (e.g., “salt”) would be considered an identifying element. This is because the resulting value would be susceptible to compromise by the recipient of such data.”
Where it was read
Also read from the same source
- HHS OCR guidance on de-identification (2012): who is an expert (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.2)
- HHS OCR guidance on de-identification (2012): how an expert works (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)
- HHS OCR guidance on de-identification (2012): no fixed numerical risk level (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.3)
- HHS OCR guidance on de-identification (2012): methods and results documented (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)
- HHS OCR guidance on de-identification (2012): time-limited determinations (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.4)
- HHS OCR guidance on de-identification (2012): what actual knowledge means (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.6)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide