The 18 HIPAA Identifiers: Full List and Therapy Examples

The 18 HIPAA identifiers are the details HIPAA's Privacy Rule says you must remove, for a client and for their relatives, employers and household members, before health information counts as de-identified under the method HHS calls Safe Harbor. They are a test for de-identification, not a definition of protected health information (PHI). A client's first name on your calendar can be PHI, and a case with every listed identifier removed can still point to one person.

Below you'll find the list in the regulation's own words (45 CFR 164.514(b)(2)), what each identifier looks like in a therapy practice, the two de-identification methods, and what is and isn't PHI. The PHI examples come from everyday practice: a calendar invite, a voicemail, a session recording, a case for supervision and a testimonial. Then come what you can share without violating HIPAA, rules for the tools you use every day, and a checklist to copy before you present or publish a case. Every client in this article is invented.

The 18 HIPAA identifiers: the full list

Under Safe Harbor, information is de-identified only when two conditions are met. First, "the following identifiers of the individual or of relatives, employers, or household members of the individual, are removed" (45 CFR 164.514(b)(2)(i)). The regulation letters them (A) through (R). Here they are numbered 1 to 18, word for word:

Names;
All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
Telephone numbers;
Fax numbers;
Electronic mail addresses;
Social security numbers;
Medical record numbers;
Health plan beneficiary numbers;
Account numbers;
Certificate/license numbers;
Vehicle identifiers and serial numbers, including license plate numbers;
Device identifiers and serial numbers;
Web Universal Resource Locators (URLs);
Internet Protocol (IP) address numbers;
Biometric identifiers, including finger and voice prints;
Full face photographic images and any comparable images; and
Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section;

Second, the covered entity must not have "actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information" (164.514(b)(2)(ii)). For a therapist, that second condition often matters more than the list, as the examples below show.

What each identifier looks like in a therapy practice

Names: the client's, and also their partner's, children's, parents' and employer's. Initials don't count as removed. HHS says a data set with "patient initials, or the last four digits of a Social Security number, would not meet the requirement" (HHS de-identification guidance).
Places smaller than a state: street address, city, county, ZIP code. A named school, church or gym isn't listed by name, but it places a person as precisely as an address does; treat it under number 18.
Dates: birth date, intake date, session dates, discharge from a hospital, the date of a death in the family or of an arrest. Only the year may stay. Ages over 89 become "90 or older."
Telephone numbers: including the number a voicemail came from.
Fax numbers: still on many referral and records forms.
Email addresses: personal and work addresses alike.
Social Security numbers: on insurance and intake paperwork.
Medical record numbers: your client ID or chart number.
Health plan beneficiary numbers: the client's insurance member ID.
Account numbers: a billing account or card number.
Certificate and license numbers: a driver's license, or a client's professional license number.
Vehicle identifiers: license plates, which turn up in notes about accidents or DUI cases.
Device identifiers: serial numbers, including those of a phone or a medical device.
URLs: a client's blog, personal website or social media profile.
IP addresses: in video session logs, website analytics and online form submissions.
Biometric identifiers: fingerprints and voice prints. A session recording carries the client's voice.
Full-face photos and comparable images: video stills, screenshots of a session, a scanned photo ID.
Anything else unique: a rare job, a public role, an event that was in the news, a distinctive tattoo, an unusual family story. HHS's own example is an occupation listed as "current President of State University."

What PHI is, and why the 18 identifiers aren't the definition

HIPAA defines PHI as individually identifiable health information: information that "relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual," and that identifies the person or gives "a reasonable basis to believe the information can be used to identify the individual" (45 CFR 160.103). It covers any form: information "transmitted or maintained in any other form or medium," so a hallway conversation, a sticky note and a printed schedule count, not only electronic records.

HHS spells out how an ordinary detail becomes PHI: "Identifying information alone, such as personal names, residential addresses, or phone numbers, would not necessarily be designated as PHI." In a phone book, a name isn't PHI. But "if such information was listed with health condition, health care provision or payment data, such as an indication that the individual was treated at a certain clinic, then this information would be PHI" (HHS de-identification guidance).

For a therapist that last sentence settles most questions. The fact that someone is your client is health information. Their name in your appointment book, their number saved in your phone and their email in your billing system are all PHI. Two things follow:

PHI doesn't need one of the 18 identifiers.A story with no name can still identify a client to someone who knows them.
Removing the 18 isn't always enough.If you know the remaining details would identify the client to your audience, the information isn't de-identified.

Does HIPAA apply to you?

HIPAA's rules bind covered entities and their business associates. A health care provider is a covered entity if it "transmits any health information in electronic form in connection with a transaction covered by this subchapter," such as billing insurance electronically (45 CFR 160.103). A therapist who sees only private-pay clients may not be one. Your ethics code and your state's confidentiality laws still apply, and many therapists follow HIPAA's rules either way. Our Google Meet HIPAA guide covers the covered-entity question in more depth. Ask a lawyer if you're unsure where you stand.

Is it PHI? Six examples from a therapy practice

A client's first name in a calendar invite

PHI, in your calendar. "Sam, 3:00" on a therapist's calendar links a person to care from you, which is exactly HHS's example of a name becoming PHI. If you send Sam an invite, the entry also sits with your calendar provider and lands in Sam's inbox and calendar.

Keep client appointments in a calendar covered by a Business Associate Agreement (BAA), or in practice software that signs one. Google Calendar in a Google Workspace account with Google's BAA accepted is one option; our Gmail HIPAA guide explains that setup.
A first name or initials in your own calendar guards against a glance at your screen. It isn't de-identification.
The invite is a disclosure to the client, which HIPAA permits, but others may see it: a partner who shares the client's calendar, an employer's IT team if it's a work address. Ask each client which address to use and what the event should say. You must accommodate reasonable requests to receive communications "by alternative means or at alternative locations" (45 CFR 164.522(b)).
For a group, don't send one invite that lists every member as a guest. That tells each member who else attends.

A voicemail

PHI, in both directions. A voicemail you leave tells whoever plays it that the client knows you. One a client leaves you is health information stored by your phone service.

HHS says the Privacy Rule "does not prohibit covered entities from leaving messages for patients on their answering machines," but providers "should take care to limit the amount of information disclosed," for example "leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back" (HHS FAQ 198). The same FAQ allows a limited message with a family member who answers, using professional judgment, and says you must accommodate a reasonable request to be called somewhere else.

A message that stays within that guidance (invented): "Hi, this is Jordan returning your call. You can reach me at 555-0142. Thanks." Leave out the reason for the call, and leave out a practice name that says "therapy" or "counseling" unless the client has said it's fine.

If your voicemail service transcribes messages into email or texts, the content now lives there too. Ask a lawyer whether your phone or voicemail provider needs to sign a BAA.

A session recording

PHI, and close to impossible to de-identify. A recording holds the client's voice (the list names "voice prints" among biometric identifiers), often their face, and everything they said: names, places, dates. Bleeping out names doesn't remove a voice or a face, so treat every recording as PHI for as long as it exists.

Get permission first. APA Ethics Code 4.03: "Before recording the voices or images of individuals to whom they provide services, psychologists obtain permission from all such persons or their legal representatives." ACA B.6.c and NASW 1.03(h) say the same for counselors and social workers. ACA B.6.d also asks for permission before supervisors, faculty or peers "view recordings of sessions."
Store it only where a BAA covers it, limit who can open it, and delete it when its purpose, such as a supervision review, is over, in line with your records policy.
Ask a lawyer about your state's recording-consent law, and whether a recording you keep is part of the client's record or could count as psychotherapy notes.

A de-identified case for supervision or consultation

Not PHI if it really is de-identified, which is harder with a story than with a spreadsheet. HHS warns that "clinical narratives in which a physician documents the history and/or lifestyle of a patient are information rich and may provide context that readily allows for patient identification." A case can lose every listed identifier and still be recognizable: the only pediatric cardiologist in town, a family in a custody fight that made the local news, a colleague's sister.

Two rules apply at once, and the stricter one decides what you do:

HIPAA allows identifiable discussion for these purposes."Treatment" includes "consultation between health care providers relating to a patient," and health care operations include "training programs in which students, trainees, or practitioners in areas of health care learn under supervision" (45 CFR 164.501). The minimum necessary rule doesn't apply to "disclosures to or requests by a health care provider for treatment" (45 CFR 164.502(b)).
Your ethics code is stricter.When consulting colleagues, psychologists "do not disclose confidential information that reasonably could lead to the identification of a client/patient" without prior consent unless "the disclosure cannot be avoided" (APA 4.06). ACA B.7.b uses nearly the same words. NASW 1.07(v) says social workers "should not disclose identifying information when discussing clients with consultants unless the client has consented to disclosure of confidential information or there is a compelling need for such disclosure."

So de-identify by default for peer consultation, use the checklist below, and if you're supervised, say so in your informed consent. Our informed consent template has wording for both. Ask a lawyer whether an outside supervisor or a consultation group outside your practice changes any of this.

A testimonial, and a reply to an online review

PHI when it identifies the client, and posting it needs written authorization. A testimonial with a name or photo tells the world that person was your client. OCR's Director put it plainly in a September 2025 settlement: "Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual's PHI in a website testimonial or through a social media campaign" (HHS, Cadia Healthcare Facilities). Cadia had posted "success stories" for 150 patients and paid $182,000. In 2016 a physical therapy practice paid $25,000 for posting patient testimonials, "including full names and full face photographic images," without valid authorizations (HHS, Complete P.T.).

Ethics codes add a limit HIPAA doesn't. Psychologists "do not solicit testimonials from current therapy clients/patients or other persons who because of their particular circumstances are vulnerable to undue influence" (APA 5.05). ACA C.3.b extends that to former clients, and NASW 4.07(b) is close to APA's wording. Our therapist website examples cover what to put on your site instead.

Online reviews are the mirror image. A client's review is their disclosure, not yours, and it doesn't give you permission to confirm anything. In 2023 a New Jersey psychiatry practice paid $30,000 after replying to a negative review with "specific information regarding the individual's diagnosis and treatment of their mental health condition" (HHS, Manasa Health Center). A reply that never confirms the person is a client:

"Thank you for taking the time to write. To protect everyone's privacy, we never confirm or discuss whether a person is a client. If you'd like to talk about your experience, please call the office."

If a review worries you, ask a lawyer before you reply at all.

A number in your year-end summary

Not PHI, if nobody can be picked out. "I saw 31 clients this year, most for anxiety" identifies no one. HHS's example is a report that "only noted the average age of health plan members was 45 years," which "would not be PHI." Small numbers change that: "my one client from that small town this year" is a person.

What is not considered PHI under HIPAA

De-identified information, by either method described below. The Privacy Rule's requirements "do not apply to information that has been de-identified" (45 CFR 164.502(d)).
Aggregate figures that can't identify anyone, like the year-end summary above.
Identifiers with no link to health care: a colleague's phone number, your list of therapists you refer to, a name in a public directory. The same name on your client list is PHI.
Employment records you hold as an employer. PHI "excludes" information "in employment records held by a covered entity in its role as employer," such as a doctor's note your office manager gave you for sick leave (45 CFR 160.103).
Education records covered by FERPA. This is why many K-12 school records fall under FERPA rather than HIPAA. Ask a lawyer if you work in or with a school.
Records of a person "who has been deceased for more than 50 years." Until then, the record stays protected (45 CFR 164.502(f)).
Health information held by people HIPAA doesn't cover. What a client writes in their own journal app, posts on social media or tells a friend isn't PHI in their hands. HIPAA governs you, not your client, and other privacy laws may still cover apps.

A limited data set is not on this list. It strips 16 direct identifiers but may keep dates, town or city, state and ZIP code, and the regulation still calls it "protected health information." You can use it only "for the purposes of research, public health, or health care operations," under a data use agreement (45 CFR 164.514(e)).

And "not PHI" doesn't mean "share freely." Your ethics code and your state's mental health confidentiality laws still apply to information HIPAA doesn't cover.

Safe Harbor and Expert Determination: the two ways to de-identify

HIPAA recognizes exactly two methods (45 CFR 164.514(b)), and HHS explains both in its guidance on de-identification methods (content last reviewed February 3, 2025). HHS is candid that neither is perfect: "Although the risk is very small, it is not zero."

Safe Harbor

Remove the 18 identifiers for the client and their relatives, employers and household members, and have no actual knowledge that what's left could identify them. Points from HHS's guidance that matter for a case write-up:

No partial identifiers. Initials and the last four digits of a Social Security number fail.
Dates keep only the year. "January 1, 2009" becomes "2009." Ages over 89, stated or implied, become "90 or older."
ZIP codes keep at most three digits, and only where that three-digit area has more than 20,000 people. HHS lists the three-digit prefixes that must become 000.
Narrative text counts. "An identifier listed in the Safe Harbor standard must be removed regardless of its location in a record if it is recognizable as an identifier."
"Actual knowledge" means "clear and direct knowledge" that what's left could identify the person. HHS's example is a record listing an occupation as "former president of the State University," which "would clearly lead to an identification."
Your own name isn't on the list. HHS says "there is no explicit requirement to remove the names of providers or workforce members," but if your community knows where you practice, your name narrows the field.
No agreement is needed. "The Privacy Rule does not limit how a covered entity may disclose information that has been de-identified."

Expert Determination

A person "with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods" determines that "the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual," and "documents the methods and results of the analysis" (164.514(b)(1)). HHS says "there is no specific professional degree or certification program" for the expert, and "no explicit numerical level of identification risk" that counts as very small. The expert judges it for a specific recipient and setting.

This method can keep details Safe Harbor strips out, such as some dates or locations, when the expert finds the risk very small for that recipient. It's built for data sets: research, quality reports, outcome studies. A solo therapist presenting a case almost never needs it.

Which one fits a therapist

For consultation, Safe Harbor plus your own judgment about the audience. For publication or teaching, the client's written consent or a disguise thorough enough that they can't be identified, often both. Neither method by itself meets your ethics code. APA 4.07 allows confidential, personally identifiable information in "writings, lectures, or other public media" only if you "take reasonable steps to disguise the person," have written consent, or have legal authorization.

Keeping a key so you can find the case again

You may label de-identified material with a code and keep a key, if the code "is not derived from or related to information about the individual" and you don't disclose how to reverse it (45 CFR 164.514(c)). "Client 7" in your consultation notes, with the key kept in your records, fits. "SR-0314," built from initials and a birthday, doesn't.

HIPAA is a list of permissions, not a gag order. Our guide to what information can be shared without violating HIPAA goes through 20 therapy situations with the rule for each. For a therapist the main permissions are:

De-identified information, for any purpose.
With the client. Disclosure "to the individual" is permitted (45 CFR 164.502(a)), and clients have a right to access their records, with exceptions that include psychotherapy notes (45 CFR 164.524).
Treatment. Talking with a client's psychiatrist or physician, making a referral, consulting a colleague about their care (45 CFR 164.506; HHS's guidance on treatment, payment and operations).
Payment and health care operations, including billing, quality review and supervised training.
Family and friends involved in care, limited to what is "directly relevant to such person's involvement," when the client agrees or doesn't object after being given the chance. If the client can't agree, you may share when you judge it in their best interests (45 CFR 164.510(b); HHS's mental health guidance).
Appointment reminders. They "are considered part of treatment of an individual and, therefore, can be made without an authorization" (HHS FAQ 286).
Incidental disclosures that happen despite reasonable safeguards. HHS allows sign-in sheets and calling names in a waiting room "so long as the information disclosed is appropriately limited" (HHS FAQ 199).
Business associates that sign a BAA: your practice software, video platform, billing service.
Disclosures required by law and other public-interest exceptions (45 CFR 164.512). These include abuse reporting, court orders and subpoenas under conditions, and disclosures you believe in good faith are "necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public," made "consistent with applicable law and standards of ethical conduct." Your state sets your reporting duties and any duty to warn. Ask a lawyer.
Everything else needs a written authorization (45 CFR 164.508): testimonials and other marketing, an identifiable case in a book or a talk, information sent to an employer or a school.

Three things narrow that list:

Minimum necessary.Share only what the purpose needs (45 CFR 164.502(b)). The rule doesn't apply to disclosures to another provider for treatment, or to the client.
Psychotherapy notes.Notes kept separate from the record need an authorization for almost any use or disclosure. The exceptions include "use by the originator of the psychotherapy notes for treatment" and the practice's "own training programs in which students, trainees, or practitioners in mental health learn under supervision" (45 CFR 164.508(a)(2)).
Stricter law and ethics.A state law on health information privacy that is "more stringent" than HIPAA stays in force (45 CFR 160.203), and many states have mental health confidentiality laws. Federally assisted substance use disorder programs also follow 42 CFR Part 2. Your ethics code can ask for more than HIPAA, as the consultation example shows. Ask a lawyer.

Practical rules for a therapist's daily tools

Calendar

Follow the calendar invite example above: a calendar covered by a BAA, a first name or initials in the title, no reason for the visit, a separate invite for each group member.
Keep client appointments off shared family calendars and personal accounts, and off smart speakers or displays that read the day's events aloud.

Email

Use a business account whose provider signs a BAA. Our Gmail HIPAA guide walks through Google Workspace.
Neutral subject lines: "Your appointment on Thursday," not "Follow-up on your panic attacks."
HHS says the Privacy Rule "does not prohibit the use of unencrypted e-mail for treatment-related communications," with safeguards such as "limiting the amount or type of information disclosed," and other means offered to anyone who finds it unacceptable (HHS FAQ 570).
Check the address before you send, and use Bcc or separate emails for a group.
Don't forward client email to a personal account.

Text messages

HHS hasn't published a texting FAQ for patients; its email FAQ is the closest guide. Ask a lawyer.
Keep texts to logistics: a time, a link, "running five minutes late."
Record the client's consent to texting at intake, and if texts carry client information, use a business number from a service that signs a BAA.
Turn off message previews on your lock screen, and never put two clients in one group text.
If a client texts something clinical, reply briefly to bring it into a session, and follow your crisis procedure if a text suggests risk.

Phone and voicemail

Leave messages as in the voicemail example above, and honor requests to call a different number.
If your phone syncs contacts to a personal cloud account, client names and numbers go with them. Keep client contacts in a business account.

Video sessions

Use a platform that signs a BAA, set up as its documentation describes. Our Google Meet guide shows what that involves.
Use a private room, headphones and a closed door. Ask the client to do the same and to tell you if someone else is in the room.
No recordings or screenshots without written consent.
Before you share your screen, close the calendar and the client list.

Session notes

The record is supposed to identify the client, so it doesn't need de-identifying. It needs a system covered by a BAA, strong sign-in and limited access.
What a client tells you about family members is part of the client's PHI. Write what is clinically relevant.
If you keep psychotherapy notes, keep them separate from the record. That separation is part of HIPAA's definition (45 CFR 164.501).
Keep client details out of personal note apps, sticky notes and notebooks that leave the office.

Case consultation and supervision

De-identify for peer consultation unless the client has consented, and ask yourself whether anyone in the room might know the client. If someone might, change more or ask for consent. That's the "actual knowledge" condition at work.
Treat a post in an online consultation group or listserv as a publication. Members may live near your client, and posts get copied.
Hold any identifiable discussion on a video tool covered by a BAA, not in a group chat.

Writing, teaching and social media

An identifiable case in public needs the client's written HIPAA authorization.
ACA G.5.a allows client information in a presentation or publication "only when (a) participants, clients, students, or supervisees have reviewed the material and agreed to its presentation or publication or (b) the information has been sufficiently modified to obscure identity." NASW 1.07(u) asks for consent before identifying clients "for teaching or training purposes," and 1.07(r) says to avoid "posting any identifying or confidential information about clients on professional Web sites or other forms of social media."
Composite cases, blended from several clients and labeled as composites, are the usual way to teach without exposing one person.
Apply the client test: if the client read this, would they recognize themselves and feel exposed? Others may not know them, but they would.
Don't post about a session in real time. "Tough session today with a teen who..." plus the date, your location and your followers can be enough.

A checklist for de-identifying a case before consultation or publication

Copy this into your notes or your consultation group's guidelines.

Case de-identification checklistTemplate

CASE DE-IDENTIFICATION CHECKLISTGeneral information, not legal advice.

1. PURPOSEI know why I'm sharing and who will see or hear itI'm sharing only what my question needsPublication, teaching or social media: I have the client's written consent, a disguise strong enough that they can't be identified, or both

2. THE 18 IDENTIFIERSCheck the client AND relatives, employers, household.No names, nicknames or initialsNo street, city, county, neighborhood or ZIP codeNo dates except the year: birth, sessions, eventsAny age over 89 shown as "90 or older"No phone, fax, email, URL or social media handleNo SSN, record, insurance, account or license numberNo plate, device or serial number, no IP addressNo photo, video, voice or screenshotNo other unique number, code or characteristic

3. THE STORYEmployer, school and faith community not namedJob made general ("works in health care")Rare events, public roles and news stories removedUnusual details changed only where the change doesn't alter the clinical pictureGroup told that details were changedRecognizable quotes paraphrasedSmall-world test: nobody present is likely to know the client, or I've changed moreClient test: if the client read or heard this, it wouldn't harm them or break their trust

4. THE FILEFile name, title and slide notes carry no nameComments, tracked changes and document properties clearedAnything identifiable shared only through a tool covered by a BAACopies deleted after the consultation

5. THE RECORDSigned consent filed, if I relied on consent

Before and after: one invented case

Before (identifiable; the client, names and places are invented): "Dana R., 34, an ICU nurse at Ashford General in Ashford, started weekly sessions on March 3 after her brother Luis died in a highway crash that was all over the local news. She lives with her wife, Kim, a teacher at Pine Ridge Elementary. Since the funeral she has had panic attacks on night shifts. Her PHQ-9 at intake was 17."

After (for a consultation group): "A client in her 30s who works night shifts in health care began weekly sessions this year, a few weeks after a sudden death in her family. She lives with her partner. Since the loss she has had panic attacks at work. Her PHQ-9 at intake was 17. My question for the group is how to pace exposure work while she's still grieving."

What changed and why:

Name and initials:removed (identifier 1).
Age 34:Safe Harbor allows an exact age under 90, but "in her 30s" is harder to match.
"ICU nurse at Ashford General":the employer's name is an identifier, and "ICU nurse" in a small city narrows the field (identifier 18). Now "works night shifts in health care."
Ashford:a city (identifier 2). Removed.
March 3:a date element other than the year (identifier 3). Now "this year."
"Her brother Luis" and the crash in the news:a relative's name, and an event that would identify the family. Now "a sudden death in her family."
"Her wife, Kim, a teacher at Pine Ridge Elementary":a household member's name and employer. Now "her partner."
PHQ-9 of 17:kept. It isn't an identifier, and the consultation needs it.

If someone in your consultation group lives in Ashford or works at that hospital, even the "after" version may be too much. That's when you change more or ask the client first.

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. For this article, what matters is how few places client information has to go.

Booking without back-and-forth.Clients pick a time on your online booking page, so fewer names and appointment times pass through your personal inbox or phone.
Forms filled in online, not emailed.The form library has ready-made templates you send to a client for a session, including intake, consent to treat, telehealth consent, release of information, PHQ-9 and GAD-7. The client fills them in online and the answers wait with the session. TranqBay doesn't score forms automatically.
Video sessions and notes together.Video sessions are HIPAA-ready, and session notes can be written in BIRP, DAP, SOAP or GIRP format or as a blank note. Structured formats are part of the advanced note templates, which some plans include.
A BAA, with a line on de-identification.TranqBay signs a Business Associate Agreement with therapists who are covered entities; it applies automatically when you accept the Terms of Service. It also says: "We will not provide data aggregation services or de-identify PHI unless you agree in writing." You can read TranqBay's Business Associate Agreement before you decide anything.

TranqBay's BAA covers TranqBay, not your phone or your inbox, so the rules above still apply to those. To see what your clients would see first, look at a practice website template and the booking page on practice.tranqbay.health. A good practice website explains your approach, your services and the first session clearly, without a single client story.

Frequently asked questions about the 18 HIPAA identifiers

Are the 18 HIPAA identifiers the same as PHI?

No. PHI is individually identifiable health information held by a covered entity or business associate. The 18 identifiers are what Safe Harbor makes you remove before information counts as de-identified. A name in a phone book isn't PHI; the same name on your client list is.

Is a client's first name alone PHI?

On your calendar, client list or voicemail, yes, because it links a person to care from you. Under Safe Harbor all names go, first names included.

Are initials enough to de-identify a case?

No. HHS says data containing "patient initials, or the last four digits of a Social Security number, would not meet the requirement" of Safe Harbor. Say "the client," or use an invented name and say it's invented.

Can I talk about a client in supervision or a consultation group?

HIPAA allows identifiable consultation between providers about a client's care, and supervised training. Most ethics codes still ask you to leave out identifying information unless the client consents or it can't be avoided. De-identify for peer groups, and tell clients about supervision in your informed consent.

Can I put client testimonials on my website?

An identifiable testimonial needs a valid written HIPAA authorization, and ethics codes bar soliciting testimonials from current clients and others vulnerable to undue influence (the ACA adds former clients). Many therapists leave them out.

Can a de-identified case include the client's age or ZIP code?

Under Safe Harbor, an age of 89 or under and the year of an event can stay, and ages over 89 become "90 or older." Only the first three ZIP digits can stay, and only where that area has more than 20,000 people. In a case discussion, broader is better: "in her 30s," "in the Pacific Northwest."

What if a case I shared turns out to be identifiable?

Then it was PHI, and a disclosure HIPAA doesn't permit "is presumed to be a breach" unless a risk assessment shows "a low probability that the protected health information has been compromised." The factors include "the types of identifiers and the likelihood of re-identification" (45 CFR 164.402). Ask a lawyer promptly; state law may add its own duties.

Ask three questions. Could this identify the client to this audience, even without a name? If it could, is the sharing permitted (treatment, supervision, the client's written authorization), and does your ethics code agree? Am I sharing only what the purpose needs? If you can't answer the last two with a yes, de-identify with the checklist or don't share.

If you'd like booking, video sessions, session notes and client forms in one place under one BAA, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

27 sources

Regulations 13HHS 10Associations 4

Laws and regulations13

U.S. Department of Health and Human Services10

Professional associations4

Updated October 25, 2026. Found it useful? Send it to a colleague.