Does the Safe Harbor scan mean my data is HIPAA de-identified?

[cognis-digital]

A recurring question: is deidproof's "HIPAA Safe Harbor" check sufficient to declare data de-identified under 45 CFR 164.514(b)?

Short answer: no tool can make that determination for you. deidproof detects the 18 Safe Harbor identifier categories (S1-S18) by column name and by cell content, and it computes k-anonymity and l-diversity. That is a strong, reproducible, machine-checkable first pass -- but Safe Harbor also has a subjective clause (the covered entity must have no actual knowledge that the residual information could identify an individual), and the alternative Expert Determination method is a statistical judgment deidproof does not attempt.

Also worth understanding about the detectors:

• Detection is heuristic (regex + header keywords). It can miss identifiers written in unusual formats and can flag false positives (see the age-heuristic and IPv6 notes in the issue tracker).
• l-diversity here is distinct l-diversity; it does not defend against a skewness attack where a class is technically diverse but effectively homogeneous.

Use deidproof to catch the obvious leaks and to produce audit evidence -- not as a substitute for a qualified privacy review. Questions about a specific column or format? Post them here with a synthetic example.