Redacted Medical Records: HIPAA's 18 Identifiers and How to Remove Them

Unfortunately, we have to share medical records more often than we can imagine. When it happens, these docs simply leave the safety of a provider's systems. The bad news is that every time it happens, the redaction should be part of the process:

• Litigation/court filings. When it comes to the records that are used as evidence in injury, malpractice, or disability cases, it is crucial to remove all PHI. Thus, all people who are not related to the case won't see it.
• Insurance and billing disputes. When you deal with claims reviews and appeals, you have to regularly send records to third parties. But they don't need to see everything in those docs.
• Research and case studies. Publishing clinical findings requires de-identified source material.
• Sharing of docs by patients. They send their own records to advocates or look for second opinions from other experts. But in most cases, there is no need to give full docs, just a fraction of some content visible is enough.
• Staff training/audits. Real docs can be the best training material only if they do not identify real people.

Unfortunately, everything mentioned above is not just some theory. In 2025, 772 large healthcare data breaches were reported to the HHS Office for Civil Rights. As a result, the records of nearly 138.5 million people were shared with people absolutely not related to them. It is important to mention that healthcare has held the highest average breach cost of any industry for over a decade, at $7.42 million per incident. Most of those breaches are network attacks. But improper disclosure of unredacted documents is the category an organization controls completely. It is the preventable one.

You are not going to see a lot of use of the word "redaction" in HIPAA's Privacy Rule. What you see is that it talks about de-identification and the minimum necessary standard. And redaction is how both are done on documents.

The Privacy Rule (45 CFR §164.514) provides two ways to remove identifying information from health data:

1. Safe Harbor. Remove all 18 categories of identifiers listed in §164.514(b)(2). Plus, you have to be sure the remaining info cannot be used to identify this or that person. This method can be seen in all redaction workflows. Besides, we talk about it in the guide.
2. Expert Determination. A qualified statistician applies accepted methods and documents that the re-identification risk is "very small". This works best for large research datasets. It's much better than sharing docs day to day.

Alongside de-identification sits the minimum necessary standard: even when disclosure is permitted, you share only the information the recipient needs. In practice, that means redacting a record down to the relevant visit, diagnosis, or date range – not handing over the full chart because one page of it matters.

Getting this wrong is expensive. Following the penalty update published in the Federal Register on January 28, 2026, HIPAA civil monetary penalties now range from $145 to $2,190,294 per violation depending on culpability, and state attorneys general can bring separate actions. Individual OCR settlements regularly land in six and seven figures.

Safe Harbor requires removing all of the following for the patient and for the patient's relatives, employers, and household members:

The last category is the one that catches people: "the only firefighter in a town of 400 with this diagnosis" identifies someone as surely as a name does. Safe Harbor also requires that you have no actual knowledge the remaining data could identify the patient – the list is the floor, not the whole test.

A properly de-identified record keeps the clinical content intact while removing the patient's identifiers:

Medical records are compound documents: typed notes, scanned faxes, lab PDFs, images. Note which pages are scanned, because image-based pages need OCR before any text-based tool can find identifiers in them.

Manual review means reading every page against the checklist above, including headers, footers, margins, and stamps – identifiers like MRNs repeat on every page, and dates hide inside narrative text ("seen three days after her March 12 admission"). Automated detection reads the full text layer and flags names, dates, numbers, and addresses pattern-wide, which is the practical difference on a 200-page chart. A dedicated healthcare redaction tool is tuned to exactly these categories (MRNs, member IDs, dates of service) and processes the document in one pass.

True redaction deletes the underlying text and image data. Drawing black rectangles in an editor or annotator leaves the text selectable underneath – the most common failure mode in published court documents. If the visual layer changes but the text layer doesn't, it isn't redacted.

PDF metadata, embedded file properties, and revision history can carry patient names and provider details even after the visible content is clean. Flatten and sanitize the file as part of the export.

Search the finished file for known identifiers (try selecting and copying "redacted" areas – if text copies out, it's still there), check every page including scanned ones, and confirm the file properties are clean. For a deeper look at what failure looks like, see what happens when redaction fails.

The terms overlap but aren't interchangeable. Redaction is the document-level act of removing specific content. De-identification is HIPAA's legal status – a record that satisfies Safe Harbor or Expert Determination is no longer PHI and falls outside the Privacy Rule. Anonymization is the stronger, mostly GDPR-associated concept of making re-identification impossible by any party. Redacting the 18 identifiers is how a document typically achieves de-identified status; whether it's "anonymous" in the European sense is a separate, stricter question. If your documents also contain financial or general personally identifiable information, the same pass should cover those categories too – a hospital bill mixes PHI with account and card data on one page.