HIPAA Privacy Rule: re-identification codes (45 CFR 164.514(c))
A record key may survive de-identification only if it is not derived from the person's data and the key to reverse it never leaves the covered entity.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that: (1) Derivation. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and (2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.”
Where it was read
Also read from the same source
- HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))
- HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))
- HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))
- HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))
- HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))
- HIPAA Safe Harbor: any other unique number, characteristic or code (45 CFR 164.514(b)(2)(i)(R))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide