{"page":"/blog/hipaa-de-identification-ad-audiences","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Provision","What it says","Source"],"rows":[["45 CFR 164.514(b)(1)","Expert determination calls for a qualified person to assess and document very small identification risk for an anticipated recipient.","Source text"],["45 CFR 164.514(b)(2)(i)","Safe harbor lists identifiers to remove, including email addresses, device identifiers, web addresses and internet protocol addresses.","Source text"],["45 CFR 164.514(b)(2)(ii)","Safe harbor also requires no actual knowledge that the remaining information can identify the person.","Source text"],["45 CFR 164.514(c)","A code for re-identification has separate conditions on derivation, use and disclosure of the mechanism.","Source text"],["RCW 19.373.010, deidentified data","Washington’s definition calls for reasonable measures, a public commitment and recipient contract duties.","Source text"],["GDPR Article 4(5) and Recital 26","European Union law distinguishes pseudonymisation from data that does not relate to an identifiable person.","Source text"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://www.law.cornell.edu/cfr/text/45/164.514"],["https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true"],["https://eur-lex.europa.eu/eli/reg/2016/679/oj"]]}