How do I find a healthcare dataset that is de-identified and HIPAA-safe?

To find a healthcare dataset that is de-identified and HIPAA-safe, look for datasets that meet one of these common standards:

1) Check for HIPAA-compliant de-identification

Under HIPAA, data is generally considered de-identified if it has been stripped of direct identifiers such as:

• Names
• Addresses smaller than a state
• Dates directly tied to an individual (often limited or shifted)
• Phone numbers
• Email addresses
• Social Security numbers
• Medical record numbers
• Full-face photos
• Any unique identifying numbers or codes

Look for either:

• Safe Harbor de-identification, or
• Expert Determination de-identification

If a dataset description explicitly says it is HIPAA de-identified, de-identified under Safe Harbor, or expert-determined de-identified, that’s a good sign.

2) Use reputable data sources

Good places to search:

• PhysioNet – many clinical datasets, often with access controls and de-identification notes
• NIH / NCBI repositories
• CMS public use files
• MIMIC datasets via PhysioNet (requires credentialing and training, but widely used)
• HealthData.gov
• Kaggle only if the dataset provenance and de-identification are clearly documented
• ICPSR or university data archives for health studies
• CDC public datasets

3) Verify the dataset documentation

Before using it, look for:

• A data dictionary
• A de-identification statement
• A data use agreement
• A description of how dates, locations, and rare conditions were handled
• Whether the dataset contains free-text notes (these can accidentally reveal identities)

4) Be careful with “anonymized” claims

“Anonymized” is not always enough. Some datasets may still allow re-identification when combined with other data. Prefer datasets that explicitly state:

• HIPAA de-identified
• Safe Harbor compliant
• Expert determination performed
• No direct identifiers and minimal quasi-identifiers

5) If you need patient-level detail, consider controlled-access data

If your project needs rich clinical variables, you may need a dataset that is:

• De-identified but controlled-access, or
• Available only after approval/training/DUA

This is often still HIPAA-safe, but access is restricted.

Quick checklist

A dataset is safer to use if:

• It has no direct identifiers
• Dates are generalized or shifted
• Geographic detail is limited
• It includes a de-identification method
• It comes from a trusted repository
• It has a data use agreement or access controls if needed

If you want, I can help you find specific HIPAA-safe datasets for a particular topic, like ICU data, claims data, imaging, or EHR records.