Research
Should you redact ZIP codes? The 3-digit rule and why it fails
For a client document going to an AI, redact the whole ZIP code. HIPAA's Safe Harbor lets you keep the first three digits only where every ZIP sharing them holds more than 20,000 people, according to current Census data; otherwise they become 000. Applying that correctly needs an up-to-date population table, and even a valid 3-digit prefix reveals the region and often the city. NIST's research summary shows why ZIP matters: with birth date and sex, a 5-digit ZIP made most Americans unique.
Last reviewed · 4 sources
The rule, in the regulation's words
45 CFR 164.514(b)(2) removes "all geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code", "except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000."
Why it fails in practice
- It depends on current Census population data for every 3-digit area. Keeping that table correct is ongoing work, and a stale table silently lets small areas through.
- It was written for releasing health datasets, not for one detailed document with a name, an employer and a date beside the ZIP.
- A valid prefix still places people. The Article 29 Working Party's example: keeping "750*" shows every person lives in Paris. A 3-digit ZIP does the same for a US region.
- It buys little: an AI drafting a letter or reviewing a contract rarely needs any part of the ZIP. If location matters, the state usually suffices.
Why ZIP codes identify people
NIST's de-identification report (NISTIR 8053) recounts Latanya Sweeney's finding that "up to 87% of the U.S. population could be uniquely identified by their 5-digit ZIP code, date of birth, and sex based on the 1990 census", and that a follow-up study "computed a re-identification rate of 62% using the year 2000 census." A client document usually contains all three.
What the court rules keep
US federal filing rules draw a different line for public records: the criminal rule lets a filer include "the city and state of the home address". That is a floor for court filings, not a standard for de-identifying a document, and it still drops the street and ZIP.
Where PiBye fits
How PiBye handles this
PiBye redacts 5-digit ZIP codes and ZIP+4 in full. It matches them after a state name or a ZIP label, because a bare five-digit number in a legal or financial document is usually an amount or a case number. You see every replacement in review before anything is shared.
1.0.1 · macOS 14.8.5 or later · Apple Silicon · 1.1 GB
Frequently asked questions
Is keeping 3 ZIP digits HIPAA de-identification?
Only under the Safe Harbor conditions: every ZIP sharing the prefix must hold more than 20,000 people per current Census data, with the rest of the identifier list removed too. This page is not a HIPAA determination.
Should I keep the state?
Usually yes if the task needs it. Safe Harbor removes only geographic units smaller than a state.
Sources
- 45 CFR § 164.514: other requirements relating to uses and disclosures of protected health information, Legal Information Institute, Cornell Law School. Checked 25 September 2026.
- NISTIR 8053: De-Identification of Personal Information, National Institute of Standards and Technology, October 2015. Checked 25 September 2026.
- Opinion 05/2014 on Anonymisation Techniques (WP216), Article 29 Data Protection Working Party, April 10, 2014. Checked 25 September 2026.
- Federal Rules of Criminal Procedure, Rule 49.1: privacy protection for filings made with the court, Legal Information Institute, Cornell Law School. Checked 25 September 2026.