HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))
Anything more precise than a state goes. A three-digit ZIP prefix may stay only where the area it covers holds more than 20,000 people; otherwise it becomes 000.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: ... The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and ... The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.”
Where it was read
Also read from the same source
- HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))
- HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))
- HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))
- HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))
- HIPAA Safe Harbor: any other unique number, characteristic or code (45 CFR 164.514(b)(2)(i)(R))
- HIPAA Safe Harbor: the no actual knowledge condition (45 CFR 164.514(b)(2)(ii))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide