Hipaa Deidentification

HIPAA De-Identification Methods — 45 CFR §164.514(a)-(b)

Overview

De-identification is the process by which protected health information (PHI) is stripped of identifying elements such that it no longer identifies an individual and there is no reasonable basis to believe it can be used to identify an individual. Under 45 CFR §164.514(a), health information that has been de-identified is no longer PHI and is not subject to the HIPAA Privacy Rule. HIPAA provides two permissible methods for de-identification: expert determination (§164.514(b)(1)) and safe harbor (§164.514(b)(2)). The choice of method depends on the nature of the data, the intended use, and the organization's risk tolerance and resources. OCR published detailed guidance on de-identification methods in November 2012 (updated September 2023), providing extensive clarification on both methods.

Legal Framework

Definition of De-Identified Information — §164.514(a)

Health information is de-identified if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual. The standard is met by applying either the expert determination or safe harbor method.

Key Distinction: De-Identification vs Anonymization

HIPAA uses the term "de-identification" rather than "anonymization." De-identified data under HIPAA may still carry some theoretical re-identification risk — the standard is "no reasonable basis" to believe identification is possible, not absolute impossibility. This contrasts with GDPR's concept of anonymization, which requires irreversibility.

Method 1: Expert Determination — §164.514(b)(1)

Requirements

A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable must:

1. Apply such principles and methods to determine that the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify an individual who is a subject of the information
2. Document the methods and results of the analysis that justify the determination

Qualified Expert

OCR guidance does not specify required credentials but indicates the expert should have knowledge in:

• Statistical methods for assessing disclosure risk (k-anonymity, l-diversity, t-closeness)
• Re-identification attack methodologies (linkage attacks, inference attacks)
• Publicly available data sources and their linkage potential
• Health data characteristics and population uniqueness

Typical qualifications include PhD-level training in statistics, biostatistics, data science, or computer science with specialization in privacy or disclosure limitation.

Expert Determination Process

Step 1: Threat Modeling

The expert identifies plausible re-identification scenarios:

Step 2: Risk Quantification

The expert applies statistical methods to quantify re-identification risk:

Population Uniqueness Analysis: Assess how unique combinations of quasi-identifiers are in the relevant population.

Commonly used metrics:

Step 3: Transformation Application

The expert specifies transformations to reduce risk to an acceptable level:

Step 4: Documentation

The expert must document:

• Qualifications and experience
• Methodology applied
• Data analyzed (original and transformed)
• Risk metrics computed
• Justification for risk thresholds selected
• Residual risk assessment
• Any conditions on data use that affect the risk determination

Asclepius Health Network engages an external expert (PhD biostatistician with healthcare disclosure risk expertise) for expert determination on research datasets. The expert's report is retained as required documentation.

Method 2: Safe Harbor — §164.514(b)(2)

Requirements

Remove the following 18 categories of identifiers of the individual or of relatives, employers, or household members:

Additional Safe Harbor Requirement

The covered entity must have no actual knowledge that the remaining information could be used alone or in combination with other information to identify an individual.

Asclepius Health Network Safe Harbor Implementation

Asclepius Health Network uses an automated de-identification pipeline for data released under the safe harbor method:

1. Structured data: EHR extraction scripts strip all 18 identifier categories from structured fields. Date fields are transformed to retain year only (or year and quarter if research protocol requires and dates are not directly related to the individual). Ages over 89 are mapped to 90+. ZIP codes are truncated to 3 digits and validated against the Census Bureau threshold table.

2. Unstructured data (clinical notes): NLP-based named entity recognition (NER) system identifies and redacts names, locations, dates, phone numbers, SSNs, MRNs, email addresses, URLs, and other identifiers in free-text clinical notes. Redacted text is replaced with category-specific tags (e.g., [DATE], [NAME], [LOCATION]). Human review sample (10% of documents) validates NER accuracy.

3. Imaging data: DICOM header scrubbing removes patient name, ID, dates, institution name, and all private tags. Burned-in annotations on images are reviewed and redacted for identifiers (facial photographs require defacing algorithms).

4. Quality assurance: Post-de-identification audit scans output datasets for residual identifiers using regular expressions, dictionaries of patient names, and cross-reference against the source dataset. Any residual identifiers trigger re-processing and root cause analysis.