There are two ways of de-identification under the HIPAA privacy rule. The safe harbor method lists 18 direct identifiers for removal and requires the subject not to know that the residual information can be used to identify the individual. The expert determination requires an expert in the field to conclude that the risk is small and document his analysis.