Quick Answer
Can de-identified patient data be used for research without patient authorization?
Once patient CSV data satisfies the HIPAA Safe Harbor standard, HIPAA's authorization requirements no longer apply to it — it is no longer PHI under the regulation. That means it can generally be used and disclosed for research purposes without individual patient authorization, subject to any other applicable requirements (IRB review, data use agreements, state law).
The key is actually satisfying Safe Harbor — removing all 18 HHS identifier categories while preserving enough structure for the research to be useful. SplitForge Data Masking auto-detects 14 of those 18 categories in your browser — it does not cover health-plan beneficiary numbers, vehicle identifiers (VIN), or the "any other unique identifier" catch-all, and its name and date detection is heuristic, so it is not a compliance certification; you'll handle the remaining categories and verify completeness yourself. This guide covers the research-specific techniques for preserving utility in the process.
⚖️ NOT LEGAL ADVICE — This post covers HIPAA Safe Harbor de-identification for informational purposes only. Research use of patient data may be subject to additional requirements beyond HIPAA — including IRB review, data use agreements, sponsor requirements, and state law. Consult qualified legal and compliance counsel, your IRB, and your institution's privacy office before making decisions about research use of patient data.
For the complete Safe Harbor workflow across all 18 identifiers, see our complete Safe Harbor research de-identification guide.
TL;DR: HIPAA Safe Harbor de-identifies patient CSV data by removing all 18 HHS-specified identifier categories — after which the data is no longer PHI and can be used for research without patient authorization (hedged: HIPAA's authorization requirement no longer applies to it). The research challenge is preserving analytic utility through the process. Two techniques matter most: date-shifting (applying a consistent random offset per patient to preserve event intervals without retaining real dates) and age-banding (collapsing ages ≥ 90 to "90+" as Safe Harbor requires, which also enables cohort analysis). Applied correctly, Safe Harbor de-id can produce a dataset that is both compliant and useful for longitudinal and cohort analysis.
A clinical research team is preparing a 5-year patient cohort extract for a longitudinal outcomes study. The dataset includes admission dates, discharge dates, follow-up visit dates, and lab draw timestamps — all tied to individual patients. The team's question: can they keep the dates? Without the dates, the temporal structure of the study collapses.
The instinct is often to request patient authorization or to pursue a waiver of authorization through the IRB. Both are legitimate paths. But there is a third path that gets overlooked: Safe Harbor de-identification, applied with date-shifting to preserve the temporal relationships that make the study possible.
Date-shifting does not retain the real dates. It shifts all of a patient's dates by a consistent, randomly-assigned offset — so the intervals between events are preserved, but no real date remains in the file. Under Safe Harbor, dates tied to an individual are identifier category 3. Shifted dates are no longer the actual dates — they do not identify the individual. The temporal structure survives; the identifiable dates do not.
This is what research-specific de-id looks like: satisfying Safe Harbor while making deliberate decisions about what utility to preserve.
Research use of de-identified data verified against HHS Safe Harbor guidance and 45 CFR §164.514(b)(2), May 2026.
The Safe Harbor Research Exception — Scoped Correctly
Under HIPAA, PHI may be used and disclosed for research only with individual authorization, an IRB waiver or alteration of authorization, or qualification under specific Privacy Rule research provisions. De-identified data avoids this requirement — not because of a special research exemption, but because de-identified data is no longer PHI under the regulation.
45 CFR §164.514(a) states that health information is not individually identifiable, and therefore not PHI, if it does not identify an individual and if the covered entity has no reason to believe it could be used to identify an individual. Safe Harbor (§164.514(b)(2)) specifies the method: remove all 18 identifier categories and confirm no actual knowledge of residual identifying information.
Once data meets that standard, HIPAA's authorization requirements do not apply to it. It can generally be used for research purposes without individual authorization.
Scope matters here. This removes the HIPAA authorization barrier for the de-identified dataset. It does not:
- Override IRB review requirements that may apply to your research protocol
- Supersede data use agreements required by your institution or data source
- Address state law requirements that may be more restrictive than HIPAA
- Guarantee the data is anonymous — de-identified ≠ anonymous; residual re-identification risk may exist
For most covered entities, satisfying Safe Harbor clears the HIPAA compliance path for research use. The additional requirements depend on your institutional context.
Date-Shifting: Preserving Longitudinal Utility
Dates are identifier category 3 under Safe Harbor — "all elements of dates (except year) directly related to an individual, including birth date, admission date, discharge date, date of death." Dates must be removed or generalized under Safe Harbor. For longitudinal studies, stripping dates entirely destroys the temporal structure the study is built on.
Date-shifting is the technique that preserves utility while satisfying Safe Harbor. The approach:
-
Assign a random offset to each patient. Generate a random number of days — typically within a bounded range, such as ±365 days — and assign it consistently to all records for that patient. The offset is specific to the patient and is not stored in the output dataset.
-
Apply the offset to every date tied to that patient. Every admission date, discharge date, follow-up date, and lab timestamp for that patient is shifted by the same offset. The actual dates are gone. The intervals between them are intact.
-
Discard the offset table. The mapping from patient to offset value is not included in the output. Without it, the shifted dates cannot be reverse-shifted back to real dates.
What date-shifting preserves:
- Time between admission and discharge (length of stay)
- Time between follow-up visits (treatment interval)
- Time between lab draws and clinical events (temporal correlation)
- Sequence of events within a patient's record
What date-shifting removes:
- The actual calendar dates — no real date remains in the file
- The ability to link a record to a specific real-world time period
- Year of birth precision where dates that would imply age ≥ 90 are handled (see age-banding below)
Date-shifting is not the same as date-suppression. Suppression removes dates entirely, destroying longitudinal utility. Shifting preserves the intervals — the information the research needs — while removing the identifying values.
For the complete Safe Harbor handling of date fields, including birth dates and the age-90 aggregation rule, see HIPAA Safe Harbor Date De-Identification: Patient CSV.
Age-Banding: The 90+ Cohort
Safe Harbor's date requirement includes a specific age provision: all ages ≥ 90, and all date elements that could be used to derive an age ≥ 90, must be aggregated to the single category "90 or older." This is not optional for cohorts that include elderly patients.
The rule exists because individuals in their 90s and above represent a small enough population that age specificity — combined with geographic or clinical attributes — can enable re-identification.
In practice for research CSVs:
- Replace exact ages ≥ 90 with the string
90+or90 or olderin the age column - If year of birth is retained (Safe Harbor allows year of birth except when it would identify a 90+ individual), suppress or redact year of birth for records where the patient would be ≥ 90
- After date-shifting, verify that no shifted dates imply a specific year of birth for a 90+ patient
What age-banding preserves:
The 90+ cohort remains in the dataset as an identifiable group. Researchers can analyze the elderly cohort as a whole — cohort size, outcomes rates, readmission patterns — without individual-level age specificity. For most research purposes, this is sufficient.
The reclassification: A record showing age: 90+ is analytically useful. A record showing age: 97 is a Safe Harbor violation for a file containing other attributes. Age-banding makes the cohort available while satisfying the requirement.
The Research De-Id Workflow
Step 1 — Inventory your identifiers and research requirements
Before configuring the de-id run, identify which of the 18 identifier categories are present in the file and which attributes are essential for your research. Date columns, age columns, and geographic fields are the most frequent intersection of Safe Harbor requirements and research utility decisions.
Step 2 — Configure date-shifting
Open SplitForge Data Masking and load your patient CSV. For each date column, configure the date-shift action: assign a per-patient random offset within your chosen range and apply it consistently across all date fields for each patient record. The offset is applied in-memory and is not written to the output.
Step 3 — Configure age generalization
For the age column or any year-of-birth field: configure a generalization rule that collapses values ≥ 90 to "90+". For year-of-birth columns where the year implies age ≥ 90, apply suppression to those specific records.
Step 4 — Address all remaining identifier categories
Apply the standard Safe Harbor removal to the remaining 17 identifier categories present in the file. For the complete list and handling for each, see HIPAA Safe Harbor: De-Identify Patient CSV (All 18 Identifiers). All processing runs in your browser — no file is transmitted to a server, so the processing step does not create a BAA disclosure.
Step 5 — Validate the output
Before the file is shared, run validation: confirm all identifier categories have been addressed, check free-text columns for residual PHI, and assess whether retained field combinations (age-band, ZIP prefix, diagnosis code) create quasi-identifier re-identification risk. For validation guidance, see Validate PHI Removal from Patient CSV Data Before Sharing.
Step 6 — Document the de-id approach for your IRB submission
If your research protocol requires IRB review, document the de-identification method (Safe Harbor), the specific handling for date columns (date-shifting with per-patient random offset), the age-banding rule applied, and the validation steps completed. This documentation demonstrates the compliance basis for using the data without individual authorization.
For the complete privacy-first processing framework across HIPAA and other regulations, see our privacy-first data processing guide.
FAQ
De-Identify Patient Research Data Locally
Apply Safe Harbor de-identification — including date-shifting and age-banding — to your patient CSV in your browser. PHI never reaches a server, so the processing step creates no BAA disclosure.
De-Identify Research Data with Data Masking
Legal disclaimer: The content in this post is for informational purposes only and does not constitute legal advice. Research use of patient data may be subject to HIPAA, IRB requirements, data use agreements, institutional policies, and state law. Consult qualified legal and compliance counsel, your IRB, and your institution's privacy office before making decisions about research use of patient data.