Records / De-identification rules
Details that identify together are coarsened and measured
In tables, postcodes are cut to their first part (US ZIP codes to three digits, or 000 where those cover 20,000 people or fewer), birth dates to the year and ages to five-year bands topped at 90. Then every row is checked: a delivery may hold no combination of these details shared by fewer than 11 people.
Dated 15 Oct 2026Source checked 15 Oct 2026Page out of reach at the last check, 16 Oct 2026Basis: our standard
“It was found that 87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}.”
Sweeney, Simple Demographics Often Identify People Uniquely, checked 2000
Everything read from this source (1)Archived copy, 10 Oct 2026
Branson et al., Trials 21:200, checked 2020
European Medicines Agency, external guidance on Policy 0070, v1.4, pp. 49-50, checked 15 Oct 2018
Everything read from this source (1)Archived copy, 14 Sep 2026
45 CFR 164.514(b)(2)(i)(B), checked 15 Oct 2026
45 CFR 164.514(b)(2)(i)(C), checked 15 Oct 2026
UK ICO, Anonymisation guidance (k-anonymity), checked 28 Mar 2025
Everything read from this source (5)Archived copy, 7 Sep 2026
HHS, Guidance on de-identification: the 17 restricted three-digit ZIP codes (2000 Census), checked 26 Nov 2012
Everything read from this source (5)Archived copy, 5 Oct 2026
- A person reads records picked at random
- HIPAA Privacy Rule: the de-identification standard (45 CFR 164.514(a))
- HIPAA Privacy Rule: the Expert Determination method (45 CFR 164.514(b)(1))
- HIPAA Privacy Rule: the Safe Harbor method, whose identifiers must go (45 CFR 164.514(b)(2)(i))
- HIPAA Safe Harbor: geography and the three-digit ZIP rule (45 CFR 164.514(b)(2)(i)(B))
- HIPAA Safe Harbor: dates and ages over 89 (45 CFR 164.514(b)(2)(i)(C))
Cited in these 2 guides