Health information from which a covered entity has removed all 18 HIPAA identifiers as long as the covered entity has no actual knowledge that the remaining information could be used alone or in combination with other information to identify the individual to whom the information applies.