De-identifying data before AI: what HIPAA and the CCPA require

In US law, data anonymization is mostly called de-identification, and it has a definition with conditions attached. Health information is de-identified when it meets HIPAA’s Safe Harbor list or an expert’s documented determination. Consumer data is deidentified under the CCPA only when the business also commits publicly not to reidentify it and binds every recipient by contract. Meet the test and the law stops applying to that data. Miss it and the data is still yours to protect.

That matters most at the moment someone is about to paste a file into ChatGPT, Claude or Copilot. Replacing a patient’s name with a label feels like anonymizing. In legal terms it is usually pseudonymization: the key exists, someone holds it, and the text stays personal information for them.

This guide is the US legal layer. The general order of what to take out of a document, and why masking and redaction are different jobs, is in what to redact before you paste a document into an AI. The 18 Safe Harbor identifiers are walked one by one in our HIPAA compliant AI guide.

Data anonymization in US law: the defined word is de-identified

Neither HIPAA’s de-identification section, 45 CFR 164.514, nor the CCPA’s definitions section, Civil Code 1798.140, uses the word anonymous. Both define de-identified data instead, and both tie the definition to what the holder does, not only to what the file contains. The FTC, which polices privacy promises, uses the plain word, and its staff set the bar high: data is only anonymous when it can never be associated back to a person.

Term	Where it is defined	What meeting it does
De-identified health information	45 CFR 164.514(a) and (b)	Takes it out of the HIPAA Privacy Rule
Deidentified information	Cal. Civ. Code 1798.140(m)	Takes it out of CCPA personal information
Deidentified data	Texas 541.001, Connecticut 42-515	Same three duties as California
Pseudonymize, pseudonymous data	Cal. Civ. Code 1798.140(aa), Texas, Connecticut	Still personal information; some rights relaxed in some states
Anonymous	Not defined in these laws	FTC staff: only if it can never be linked back

45 CFR 164.514, California Civil Code 1798.140, Texas HB 4 (2023), Connecticut Public Act 25-113, and the FTC technology blog of July 24, 2024.

Why the holder’s conduct is part of the test

In Europe the anonymization test is mostly about the data and the means reasonably likely to be used. The US definitions add conduct. HIPAA’s Safe Harbor fails if the covered entity has actual knowledge that the rest could identify someone. The CCPA’s version fails if the business has not made a public commitment or not signed recipients up by contract.

So two companies holding the same file can be in different positions. One has de-identified data and the other has personal information, because only one of them did the paperwork. That is also why a vendor’s claim that its output is “anonymized” says nothing about your obligations. Which AI tools comply with US privacy law makes the same point about compliance badges, and our map of state privacy laws shows which states use these definitions.

HIPAA’s two routes: Safe Harbor and Expert Determination

The standard sits in 45 CFR 164.514(a): health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify one, is not individually identifiable. Paragraph (b) gives the two ways a covered entity may conclude that. Under 164.502(d), information that meets them is not subject to the Privacy Rule.

	Safe Harbor, 164.514(b)(2)	Expert Determination, 164.514(b)(1)
Who decides	The covered entity, by following a list	A person with statistical and scientific expertise
The test	18 identifiers removed, and no actual knowledge	Risk very small for an anticipated recipient
Context	The same list for every recipient	Depends on who receives it and what else they hold
Dates and ZIP codes	Year only; first three ZIP digits in some areas	Can keep more if the risk stays very small
Paper trail	None required by the rule	Methods and results documented

45 CFR 164.514(b), read on eCFR October 13, 2026, and HHS’s de-identification guidance.

Safe Harbor is the route most offices mean when they say “we de-identify”. It is mechanical, which is its strength and its limit. Expert Determination is the route for data that has to keep detail, such as dates of service in a research set, and it is the only one that looks at who will read the result. Which vendors will sign for PHI at all is a separate question, answered in our HIPAA compliant AI guide.

Both apply only to health information held by a covered entity or business associate. An employer’s own leave file is outside HIPAA, as the PHI and PII guide explains, but the Safe Harbor list is still a useful checklist for it.

Safe Harbor in practice: the list, the derivatives and actual knowledge

The list in 164.514(b)(2)(i) has 18 categories, lettered A to R, and applies to identifiers of the individual and of their relatives, employers and household members. That last phrase is the one people miss in free text: a note that names the patient’s daughter and her employer has two more identifiers in it, not zero.

HHS’s guidance adds three readings that decide most real cases.

1. No parts or derivatives. HHS answers that patient initials or the last four digits of a Social Security number do not meet Safe Harbor, which is why redacting a Social Security number means all nine digits.
2. Dates to the year. A date like January 1, 2009 can appear only as 2009. Ages over 89, stated or implied, must be grouped as 90 or older.
3. Free text counts. The standard makes no distinction between structured fields and free text: a listed identifier must be removed wherever it sits, if it is recognizable as one.

The ZIP code rule and its 17 exceptions

Geography below the state goes, with one exception: the first three digits of a ZIP code may stay if the area they cover holds more than 20,000 people, according to current Census data. Where it holds 20,000 or fewer, the three digits become 000. HHS’s guidance lists the three digit codes that fell below the line on 2000 Census data, and warns not to rely on that list if newer data has been published.

17

The codes are 036, 059, 063, 102, 203, 556, 692, 790, 821, 823, 830, 831, 878, 879, 884, 890 and 893. A file that keeps one of those prefixes does not meet Safe Harbor, however carefully the names were removed.

What actual knowledge means

Removing the 18 is half of Safe Harbor. The other half, in 164.514(b)(2)(ii), is that the covered entity does not have actual knowledge that the remaining information could be used, alone or with other information, to identify someone. HHS defines actual knowledge as clear and direct knowledge: the entity concludes that the information is not in fact de-identified. In an office this bites through context.

A summary that says “the practice’s only patient on dialysis who also coaches the high school team” has no identifier on the list, and anyone at the practice knows who it is. HHS also notes that only the names of patients and their relatives, employers and household members must go; a clinician’s name need not, unless it would give actual knowledge. The local government public records guide shows the same small numbers problem in a different setting.

Expert Determination: when the reader decides the risk

Under 164.514(b)(1), a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles determines that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify an individual. The expert documents the methods and results that justify the conclusion.

Three phrases carry the weight. “Very small” is a level of risk, not zero. “Reasonably available information” means the expert has to think about what else exists, such as public records or social media.

And “anticipated recipient” means the answer is for a particular reader. A data set safe to give a research partner under contract may not be safe to post online. The UK regulator’s motivated intruder test, described in our root guide to redaction before AI, asks a similar question in different words.

No degree, no number and no expiry date in the rule

HHS’s guidance fills in the gaps the rule leaves. There is no specific professional degree or certification for an expert; the Office for Civil Rights would review the person’s experience, training and actual experience with de-identification. There is no explicit numerical level of risk that universally counts as very small. And the rule attaches no expiration date, though HHS notes that some practitioners issue time limited certifications because technology and available data change.

0required degrees or certifications

0numerical risk thresholds in the rule

1documented analysis, always

For an office putting text into an AI tool, Expert Determination is rarely practical, because it is done on a data set for a recipient, not on each paste. Where it matters is in a vendor’s sales pitch: a tool that says its output is “HIPAA de-identified” should be able to name the method and, for Expert Determination, show the report. Our page for healthcare practices covers what a practice usually sends.

Hash codes need an expert and hidden keys

HHS addresses hashing directly. A covered entity may disclose codes derived from PHI as part of a de-identified set only if an expert determines the data meets 164.514(b)(1), and the re-identification provision does not stop hash values from being used under that route, provided the keys are not disclosed, including to the recipients. Under Safe Harbor, a hash of an identifier is a code derived from information about the individual, which section 164.514(c) does not allow.

Re-identification codes, limited data sets and the business associate step

Three provisions around the de-identification standard explain where pseudonymization fits in HIPAA, even though section 164.514 never uses the word.

The re-identification code

Section 164.514(c) lets a covered entity assign a code so that de-identified information can be re-identified later, on two conditions. The code is not derived from or related to information about the individual and cannot be translated to identify them. And the covered entity does not use or disclose the code for any other purpose, or disclose the mechanism for re-identification.

That is the closest thing in HIPAA to a pseudonym, and it comes with a sharp limit. Under 164.502(d)(2)(i), disclosing the code or other means of re-identification counts as disclosing PHI. A label like PATIENT_1 is a code; the table that says who PATIENT_1 is must stay with the covered entity.

Creating de-identified data is itself a use of PHI

Section 164.502(d)(1) says a covered entity may use PHI to create de-identified information, or disclose PHI for that purpose only to a business associate. This is the step that matters for AI. Pasting a full patient record into a chatbot and asking it to strip the identifiers is a disclosure of PHI to the vendor, made in order to de-identify. Without a business associate agreement on that plan, it is not one the rule allows.

164.502(d)(1)

Doing the substitution before the text leaves the computer means the full record is never sent for that purpose, although the text you do send may still be PHI. Which vendors sign business associate agreements, and on which plans, is in our HIPAA compliant AI guide.

The limited data set is still PHI

Between full PHI and de-identified data, section 164.514(e) creates the limited data set. It excludes 16 direct identifiers, including names, street addresses, phone numbers, email addresses, Social Security numbers and full face photos, but may keep town or city, state, ZIP code and dates. It is still PHI. It may be used or disclosed only for research, public health or health care operations, and only under a data use agreement.

The agreement must set the permitted uses and who may receive the data, and bind the recipient not to use or disclose it beyond that, to use appropriate safeguards, and not to identify or contact the individuals. A chat window is not a data use agreement. The guide to masking data in a CSV file is the practical route for spreadsheets that sit in this middle ground.

What pseudonymization is, and is not, under HIPAA

Put the three provisions together and the picture is clear. Replacing names and numbers with consistent labels, and keeping the key on your own machine, is not prohibited by HIPAA and is often the most sensible thing to do. But it does not by itself make the text de-identified.

For that, the text would also need every other Safe Harbor identifier gone, including dates more precise than the year, geography below the state and any other unique characteristic, plus no actual knowledge that the rest identifies someone. A clinical note with the name replaced and the date of service, the town and an unusual diagnosis left in fails on at least two counts.

The practical consequence

If the result is not de-identified, it is still PHI when a covered entity or business associate sends it, and the vendor relationship still needs a business associate agreement.

What pseudonymizing first buys is a smaller disclosure: the vendor receives a note about PATIENT_1, not about a named person, and the key never leaves the office. That is worth having, and it is not the same claim. The business associate agreement question is covered in our HIPAA compliant AI guide, and our page for healthcare practices shows the workflow.

What you did	Status under HIPAA
Removed all 18 Safe Harbor identifiers, no actual knowledge	De-identified
Expert documented a very small risk for this recipient	De-identified
Removed 16 direct identifiers, kept dates and ZIP	Limited data set: PHI, data use agreement
Replaced names and numbers with labels, kept the key	Still PHI unless it also meets Safe Harbor
Hashed identifiers, no expert	Still PHI

45 CFR 164.502(d) and 164.514(b), (c) and (e), with HHS’s guidance.

The CCPA’s “deidentified”: one definition and three duties

California’s definition in Civil Code 1798.140(m) has two parts. The information must be something that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer. And the business that possesses it must meet three duties. Under 1798.140(v)(3), personal information does not include consumer information that is deidentified or aggregate.

1. Reasonable measures. The business takes reasonable measures to ensure the information cannot be associated with a consumer or household.
2. A public commitment. It publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify it, except to check whether its own process meets the definition.
3. Contracts with recipients. It contractually obligates any recipient of the information to comply with all of those provisions.

What the three duties mean for a prompt

Read against an AI workflow, the third duty is the hard one.

If staff send what they consider deidentified text to a chatbot vendor, the vendor is a recipient, and the business needs a contract obliging it to keep the data deidentified and not to reidentify it. Standard consumer terms will not say that; what ChatGPT does with your data goes through what OpenAI’s terms do say. Without it, the text is not deidentified under the CCPA, whatever was removed from it.

The second duty is public. A business relying on deidentified data needs a commitment somewhere a reader can find it, which in practice means the privacy policy. Employees count as consumers in California, so HR data is in scope too; our California guide covers the rest of the CCPA for AI.

Deidentified patient information: sections 1798.146 and 1798.148

California added a separate rule for health data in 2020. Section 1798.146(a)(4) exempts from the CCPA information deidentified under HIPAA’s 164.514 that is derived from patient information originally held by an entity regulated by HIPAA, the state’s medical privacy law or the federal Common Rule. If it is later reidentified, it loses the exemption.

Section 1798.148 then bars reidentifying that information except for listed purposes, such as treatment, payment or health care operations, public health, research under the Common Rule, or contracted testing of the de-identification itself. Any contract to sell or license it must state that it includes deidentified patient information and that reidentification is prohibited, and must bind onward recipients to the same terms.

The CCPA’s “pseudonymize”: defined, and still personal information

The CCPA also defines pseudonymization, in 1798.140(aa): processing personal information so that it is no longer attributable to a specific consumer without additional information, provided the additional information is kept separately and subject to technical and organizational measures that keep the data from being attributed to an identified or identifiable consumer.

That is an accurate description of what a labeling tool does, and it does not move the data out of the law. The exclusion in 1798.140(v)(3) covers deidentified and aggregate information only. Pseudonymized data that the business can reconnect, because it holds the additional information, remains personal information under the CCPA’s general definition, which reaches data reasonably capable of being associated with a consumer.

1798.140(aa)

What pseudonymizing does buy under the CCPA is risk reduction. A service provider that never receives a name holds less, a breach of its systems exposes less, and a risk assessment has less sensitive information to describe. Our California guide explains when a CCPA risk assessment applies. What to remove before AI lists the details that carry the most weight for US paperwork.

Texas and Connecticut: the same three duties, and a pseudonymous data category

The newer state privacy laws use the same structure as California, with one addition. Texas, in the Data Privacy and Security Act, defines deidentified data as data that cannot reasonably be linked to an identified or identifiable individual, or a device linked to them, and section 541.106(a) puts the same three duties on a controller that holds it: reasonable measures, a public commitment and contracts with recipients.

Connecticut’s definition, in section 42-515 of its act, writes the three duties into the definition itself, and Public Act 25-113 kept that wording when it rewrote the definitions from July 1, 2026. Both states also define pseudonymous data, in nearly the same words as California’s pseudonymization: data that cannot be attributed to a specific individual without additional information kept separately and protected.

What pseudonymous data buys in Texas, and the catch

Texas gives pseudonymous data a real benefit. Section 541.106(c) says several consumer rights and the controller duties in section 541.101 do not apply to it where the controller can show that the information needed to identify the consumer is kept separately and under effective technical and organizational controls that prevent the controller from accessing it.

That last condition is the catch. If you pseudonymize so that you can put the names back, you can access the key, and the exemption does not fit. Section 541.106(d) adds that a controller disclosing pseudonymous or deidentified data must exercise reasonable oversight of the recipient’s contractual commitments. Our Texas guide covers the rest of that law.

	Texas	Connecticut
Deidentified data	541.001 definition; duties in 541.106(a)	42-515, duties inside the definition
Pseudonymous data	Defined in 541.001	Defined in 42-515
Oversight of recipients	Required, 541.106(d)	Contract duty in the definition

Texas HB 4 (2023) and Connecticut Public Act 25-113, section 5.

Connecticut also tells controllers to factor the use of de-identified data into each data protection assessment. Our Connecticut guide covers its AI provisions.

The FTC: hashing is not anonymization

The FTC polices privacy claims that do not match practice, and its staff have been direct about one technique. A post on the agency’s technology blog on July 24, 2024, titled “No, hashing still doesn’t make your data anonymous”, says hashes are not anonymous and can still be used to identify users, and that companies should not act or claim as if hashing personal information renders it anonymized.

The post repeats the answer of a 2012 post on the same blog and explains why. A hash turns the same input into the same output every time, so it works as a persistent identifier, and hashes of common identifiers such as email addresses, phone numbers or Social Security numbers can be reversed by guessing.

It cites the FTC’s 2015 case against Nomi, over hashed device addresses, and the BetterHelp case, where hashed email addresses sent to Facebook allegedly let it learn who was seeking counseling. It adds the 2023 complaint against Premom and the January 2024 complaint against InMarket, both over persistent device or advertising identifiers.

2012FTC blog post: hashing does not make data anonymous

2015Nomi: hashed device addresses

2023Premom: device and advertising identifiers

2024InMarket: a unique mobile device identifier

What that means for a placeholder

The same logic applies to any consistent label. A placeholder that is the same every time a name appears is useful precisely because it is stable, and that stability is what makes it pseudonymous rather than anonymous. The post ends on the point that matters for anyone describing their own process: the opacity of an identifier cannot be an excuse for improper use or disclosure.

The lesson for a business is about words. Telling clients or customers that data sent to an AI tool is “anonymized” when it is pseudonymized is the kind of claim the FTC reviews against practice.

“We replace identifiers before anything is sent, and keep the key on our own computers” is accurate. The privilege guide makes a similar point about what redaction does and does not achieve for lawyers, and whether a paste is a breach in the first place is a separate question, covered in our breach guide.

What to call what you did, and what to tell clients

Most of the trouble in this area is vocabulary, and it is cheap to fix. Describe the operation, not a legal status you have not checked.

What you did	HIPAA	CCPA and similar state laws	Accurate word
Swapped names and numbers for labels, kept the key	Still PHI	Still personal information	Pseudonymized
Removed all 18 identifiers, no actual knowledge	De-identified	Deidentified only with the three duties	De-identified (HIPAA)
Expert report for a named recipient	De-identified	Depends on the three duties	De-identified (HIPAA)
Hashed the identifiers	Still PHI without an expert	Still personal information	Hashed
Removed everything, nobody can link it back, duties met	De-identified	Deidentified	De-identified

Our summary of the sources on this page.

Two habits follow. In client communications and privacy notices, use “de-identified” only when you can name the HIPAA method or show the three CCPA duties, and use “pseudonymized” otherwise. And in your AI policy, write the rule as an operation staff can follow, such as replacing direct identifiers before anything is pasted, rather than a status they cannot check. The seven step order in the root redaction guide is a good start for that rule.

Nonimo pseudonymizes on your computer

Nonimo does not anonymize, and does not claim to. It is an app for Mac and Windows that pseudonymizes text before it reaches ChatGPT, Claude or Copilot. Whoever is drafting highlights the passage and presses one key, and the names, Social Security numbers and other identifiers it recognizes become consistent placeholders on that computer. When the answer comes back, the real details go back in on the same machine.

In the terms of this page, the key stays with you, so the text you send is pseudonymized, not de-identified: it remains PHI or personal information, and your vendor contract still matters. What changes is that the vendor never receives the names, and no outside service handles the original to strip it.

The conversation, including the map that puts the names back, is saved on the computer, encrypted, and what leaves the machine is a daily count with no text, as set out on the security page. Start from Nonimo for US teams, or see the page for law firms.

Sources

Read October 13, 2026.

• eCFR, 45 CFR 164.514: the standard in (a); Expert Determination in (b)(1); Safe Harbor’s 18 identifiers, ZIP and age rules and actual knowledge in (b)(2); the re-identification code in (c); the limited data set, its 16 identifiers, purposes and data use agreement in (e).
• eCFR, 45 CFR 164.502: (d)(1) creating de-identified information, disclosure only to a business associate; (d)(2) de-identified information outside the rule, and disclosure of a re-identification code as disclosure of PHI.
• HHS, Guidance Regarding Methods for De-identification of PHI, content last reviewed February 3, 2025: who is an expert; no numerical threshold; no required expiry; hash codes under Expert Determination with keys withheld; no parts or derivatives; dates and ages; the 17 restricted three digit ZIP codes; actual knowledge; provider names; free text.
• California Legislature, Civil Code 1798.140, as amended effective January 1, 2026: (m) deidentified and its three duties; (v)(3) the exclusion; (aa) pseudonymize.
• California Legislature, Civil Code 1798.146 and 1798.148, added by AB 713 (2020): the exemption for HIPAA deidentified patient information, its loss on reidentification, the ban on reidentifying and the contract terms for sale or license.
• Texas Legislature Online, HB 4, 88th Legislature, enrolled: Business and Commerce Code 541.001 definitions of deidentified and pseudonymous data, and 541.106.
• Connecticut General Assembly, Public Act 25-113, section 5: 42-515 definitions of de-identified data, with its three duties, and pseudonymous data (subdivisions (16) and (33) as numbered by that act), effective July 1, 2026; section 11: de-identified data in data protection assessments.
• FTC, No, hashing still doesn’t make your data anonymous, Technology Blog, July 24, 2024: hashes are not anonymous; companies should not claim hashing anonymizes; the 2012 post, and the Nomi, BetterHelp, Premom and InMarket cases.