HIPAA Safe Harbor ZIP Code De-Identification in Patient CSV Files (2026)

After removing names, SSNs, and dates from a patient dataset, an analyst assumed the job was done.

The dataset still contained the full ZIP code 89110.

In a 2024 Census dataset, that ZIP covers a neighborhood of roughly 40,000 people. In itself, that's fine — above the 20,000 threshold. But a neighboring ZIP, 89190, covers a post office with fewer than 1,000 people. Both share the 891 three-digit prefix.

The question isn't whether any individual ZIP is large enough. The question is whether the total population of all ZIP codes sharing the same 3-digit prefix exceeds 20,000. The Safe Harbor rule operates at the prefix level, not the individual 5-digit ZIP level.

Getting this wrong leaves geographic identifiers in a dataset that's supposed to be de-identified.

---

TL;DR

HIPAA Safe Harbor §164.514(b)(2)(i)(B) permits retaining only the first three digits of a ZIP code — and only if the total population of all ZIP codes sharing that 3-digit prefix exceeds 20,000 people according to current Census Bureau data. Prefixes with a combined population of 20,000 or fewer must be replaced with 000. All geographic data smaller than a state except the 3-digit prefix must be removed entirely — city names, county names, and street addresses are separate 18-identifier elements that cannot be retained under Safe Harbor. HHS publishes the list of restricted prefixes; verify it against current official guidance before any release.

Methodology note (May 2026): The geographic de-identification rule is at 45 CFR §164.514(b)(2)(i)(B). The restricted prefix list is published by HHS based on Census Bureau population data and updates with each decennial census. Verify the current list at HHS.gov before finalizing any de-identification procedure.

---

For the complete Safe Harbor workflow across all 18 identifiers, see our full Safe Harbor de-identification guide.

⚖️ NOT LEGAL ADVICE — This post covers HIPAA Safe Harbor ZIP code de-identification for informational purposes only. Whether your specific data and process satisfy Safe Harbor depends on your data, use case, and organizational context. Consult qualified legal and compliance counsel before making de-identification or sharing decisions for regulated data.

---

Table of Contents

• What §164.514(b)(2)(i)(B) Actually Requires
• The Population Threshold: How It Works
• Restricted Prefixes: Why You Can't Rely on Memory
• City and County Data: Not Preservable Under Safe Harbor
• Reality: What Geographic Columns Look Like Before De-Identification
• Decision Logic: Full ZIP to Safe Harbor Output
• Step-by-Step: Apply ZIP De-Identification in SplitForge
• Limitations
• FAQ
• Conclusion

---

What §164.514(b)(2)(i)(B) Actually Requires

The geographic identifier in Safe Harbor covers all geographic data smaller than a state. The regulation text at 45 CFR §164.514(b)(2)(i)(B) reads:

"All geographic data smaller than a State, except for the initial three digits of a ZIP code, if, according to the current publicly available data from the Bureau of the Census: The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000."

Three things follow:

1. Only 3-digit ZIP prefixes are permitted — not full ZIP codes. A 5-digit ZIP (e.g., 94105) must be truncated to its first three digits (e.g., 941) before applying the population check.

2. The population check is at the prefix level, not the individual ZIP level. Sum the population of every ZIP code that shares the same 3-digit prefix. If that total exceeds 20,000 → retain the 3-digit prefix. If 20,000 or fewer → change to 000.

3. Everything else geographic — city, county, street address, neighborhood — must be removed. These are separate Safe Harbor identifier elements. There is no population-based exception for them.

---

The Population Threshold: How It Works

The rule uses population of the geographic unit formed by combining all ZIP codes with the same three initial digits — not any individual 5-digit ZIP.

Example scenario:

Suppose a 3-digit prefix XYZ includes three 5-digit ZIPs:

• XYZ10 — population 12,000
• XYZ25 — population 8,500
• XYZ48 — population 3,200

Combined prefix population: 23,700 → exceeds 20,000 → retain XYZ.

Now suppose prefix ABC includes:

• ABC11 — population 6,000
• ABC33 — population 9,000

Combined prefix population: 15,000 → does not exceed 20,000 → replace with 000.

A patient in ABC33 does not become a problem because that individual ZIP has 9,000 people. The entire prefix-level population is what matters.

---

Restricted Prefixes: Why You Can't Rely on Memory

HHS publishes the list of 3-digit ZIP prefixes whose combined populations fall at or below 20,000, based on current Census Bureau data. These are the prefixes that must be changed to 000.

Do not hardcode any prefix list from memory, documentation, or third-party sources. The list changes with each decennial census as populations shift. A prefix that was restricted before the 2020 census may have grown above the threshold. A prefix that was safe may have declined below it.

The authoritative source is HHS, which bases the list on data from the Bureau of the Census. Before any production de-identification run involving ZIP codes:

1. Retrieve the current restricted-prefix list from HHS official guidance
2. Confirm the Census-year the list is based on
3. Apply the list to your data
4. Document the source and date of the list in your de-identification audit log

Using an outdated list is not a defense. The regulation requires verification against "current publicly available data from the Bureau of the Census."

---

City and County Data: Not Preservable Under Safe Harbor

A common misconception: "We removed the ZIP code, so we can keep the city name."

This is incorrect. City names, county names, street addresses, neighborhood names, and all other geographic subdivisions smaller than a state are part of the same identifier category — §164.514(b)(2)(i)(B). The 3-digit ZIP exception is a narrow carve-out. Nothing else is preserved from that category.

Must be removed under Safe Harbor:

State-level data is not included in the geographic identifier. A patient's state of residence may remain in the dataset.

---

Reality: What Geographic Columns Look Like Before De-Identification

A typical patient CSV with geographic data before de-identification:

patient_id,street_address,city,county,state,zip_code,latitude,longitude
PT-1001,412 Maple Street,Portland,Multnomah,OR,97201,45.5231,-122.6765
PT-2047,891 Desert View Rd,Elko,Elko,NV,89801,40.8324,-115.7631
PT-3388,55 Harbor Blvd Unit 4,Sitka,,AK,99835,57.0531,-135.3300
PT-4412,2200 Canyon Rd,Blythe,Riverside,CA,92225,33.6175,-114.5964

After Safe Harbor geographic de-identification:

patient_id,state,zip_prefix
PT-1001,OR,972
PT-2047,NV,898
PT-3388,AK,000
PT-4412,CA,922

• Street address, city, county, latitude, and longitude: removed entirely
• State: retained
• 5-digit ZIP truncated to 3-digit prefix; prefix 998 (Sitka area) checked against restricted list — if population ≤ 20,000, replaced with 000
• All prefix decisions documented with the source list and its Census-year basis

Note: Prefix population figures in this example are illustrative. Verify each prefix against current HHS guidance before applying to real data.

---

Decision Logic: Full ZIP to Safe Harbor Output

Input: 5-digit ZIP code
       ↓
Step 1: Truncate to first 3 digits → 3-digit prefix
       ↓
Step 2: Look up combined population for this prefix
        (from current HHS restricted-prefix list based on Census Bureau data)
       ↓
Step 3: Population > 20,000?
        YES → Retain 3-digit prefix in output
        NO  → Replace with 000 in output
       ↓
Step 4: Document the list source, Census year, and date of lookup
        in your de-identification audit log

All other geographic columns (city, county, street, coordinates): remove without a population check. They have no retainable exception.

---

Step-by-Step: Apply ZIP De-Identification in SplitForge

1. Load your patient CSV

Open SplitForge Data Masking and drag in your file. Processing is local — no upload.

2. Identify geographic columns

Audit all columns: address, street, city, county, zip, zip_code, postal_code, lat, lon, latitude, longitude. Flag each one.

3. Remove address, city, county, and coordinate columns

Configure masking to remove these entirely. There is no Safe Harbor exception that permits retaining them.

4. Apply ZIP truncation and restricted-prefix replacement

For each ZIP column:

• Truncate to first 3 digits
• Apply the restricted-prefix list: replace matches with 000

Verify your prefix list is sourced from current HHS guidance before this step.

5. Retain state column

State-level data is not part of the geographic identifier and may remain.

6. Review and validate output

Confirm no 5-digit ZIP codes remain. Confirm no city or county names remain. Confirm restricted prefixes output as 000. Confirm latitude and longitude columns are absent.

No data leaves the browser. Open DevTools → Network during processing — no upload requests will appear.

---

Limitations

Satisfying Safe Harbor removes data from HIPAA's definition of PHI; it does not make the data anonymous. De-identified ≠ anonymized — residual re-identification risk can remain, and "actual knowledge" that the remaining data could identify someone re-activates HIPAA obligations.

The restricted-prefix list must be sourced externally. SplitForge does not embed the HHS restricted-prefix list — it changes with Census updates and must be verified by your team against current official guidance before each production run.

Population thresholds apply to the combined geographic unit, not individual ZIPs. Applying the threshold to each individual 5-digit ZIP (rather than the combined prefix area) will produce incorrect results.

Geographic data and quasi-identifiers interact. Even a correctly de-identified 3-digit ZIP prefix can contribute to re-identification risk when combined with age, diagnosis, and other quasi-identifiers. ZIP de-identification satisfies the geographic identifier element; it does not eliminate all re-identification risk. See Validate PHI Removal for quasi-identifier checking.

Geocodes require removal. Latitude and longitude are explicitly included in the geographic identifier category ("their equivalent geocodes"). Removing the ZIP field while retaining lat/lon leaves a de-identification gap.

---

FAQ

Conclusion

ZIP code de-identification under Safe Harbor has two moving parts that compound when missed together.

Part 1: Full ZIP codes must be truncated to 3-digit prefixes — 5-digit ZIPs are not retainable under Safe Harbor.

Part 2: Not all 3-digit prefixes are retainable either. Those whose combined prefix-area population is 20,000 or fewer must become 000. The list of restricted prefixes is published by HHS and updates with Census data — using a stale list is a compliance risk.

And the easy mistake: removing the ZIP while keeping the city name. Cities are the same identifier category as ZIPs. Neither belongs in a Safe Harbor dataset.

After geographic de-identification, the dataset should contain state-level location at most, plus a valid 3-digit ZIP prefix (or 000 where required). Everything else geographic — street, city, county, coordinates — is gone.

Next: Validate PHI Removal in Patient CSV Files →