HIPAA and AI Training Data: De-identification Explained

Who HIPAA applies to

HIPAA applies to covered entities, which are health plans, healthcare clearinghouses and healthcare providers that conduct certain standard transactions electronically, and to their business associates, which are organisations that handle protected health information on their behalf. Protected health information (PHI) is individually identifiable health information held or transmitted by these entities.

Not every health-related company is covered. A healthtech app that deals directly with consumers may fall outside HIPAA while still being subject to other laws, such as state privacy laws or the FTC's rules. Organisations outside the US are generally governed by their own national laws, such as GDPR in Europe or the DPDP Act in India. Establishing whether HIPAA applies is the first step.

Why de-identification is the main route

Under the HIPAA Privacy Rule, covered entities may not use or disclose PHI except as permitted by the rule, and selling PHI generally requires individuals' authorization. Health information that has been de-identified according to the rule is no longer PHI, so these restrictions no longer apply to it.

The Privacy Rule recognises two methods of de-identification, set out at 45 CFR 164.514(b): Safe Harbor and Expert Determination. Either one is acceptable, and they suit different kinds of data.

Business associates should also check their business associate agreements. Even if de-identified data falls outside HIPAA, a business associate may only de-identify PHI if its agreement with the covered entity permits it, and the agreement may restrict what can be done with the result.

The Safe Harbor method

Safe Harbor requires removing 18 types of identifiers relating to the individual and to their relatives, employers or household members, and that the covered entity has no actual knowledge that the remaining information could identify the individual. The identifiers are:

• Names
• Geographic subdivisions smaller than a state, with a limited exception for the first three digits of a ZIP code in larger areas
• All elements of dates (except year) directly related to an individual, and ages over 89
• Telephone numbers and fax numbers
• Email addresses
• Social Security numbers
• Medical record numbers and health plan beneficiary numbers
• Account numbers and certificate or licence numbers
• Vehicle identifiers, device identifiers and serial numbers
• Web URLs and IP addresses
• Biometric identifiers and full-face photographs or comparable images
• Any other unique identifying number, characteristic or code

The Expert Determination method

Under Expert Determination, a person with appropriate knowledge of statistical and scientific methods for making information not individually identifiable applies those methods and determines that the risk is very small that the information could be used, alone or with other reasonably available information, to identify an individual. The expert documents the methods and results.

This method is more flexible than Safe Harbor. It may allow some details, such as more precise dates or geography, to be kept where the overall risk remains very small, which can preserve more of the clinical and operational context that makes data useful. It requires a qualified expert and careful documentation.

The challenge of free text and records

Structured fields are relatively easy to de-identify. Clinical notes, discharge summaries, referral letters and support conversations are harder because identifiers appear unpredictably: a family member's name, a hometown, an unusual occupation or a precise date mentioned in passing. Images, scans and recordings bring their own challenges.

Purpose-built detection tools help, but results should be checked through sampling and review. Healthcare organisations should also consider whether a limited data set, which retains some identifiers and requires a data use agreement, applies to their purposes. A limited data set is still PHI, and its permitted purposes are narrow, so it is not a general substitute for de-identification.

Practical safeguards for healthcare data

Whichever method you use, a few habits reduce risk and make the process easier to defend if questioned later.

• Confirm whether your organisation is a covered entity, a business associate or neither
• Involve your privacy officer from the start and document every decision
• Start with the least sensitive sources, such as scheduling workflows, billing processes or internal IT records
• Choose Safe Harbor or Expert Determination deliberately, based on how much detail the data needs to stay useful
• Sample and review de-identified output, paying special attention to free-text notes
• Require in the contract that the recipient will not attempt to re-identify individuals
• If you assign a re-identification code, make sure it is not derived from patient information and is never disclosed, as the Privacy Rule requires

How this fits into a data partnership

For healthcare organisations, Momentra's process allows these questions to be settled before any data moves. The first contact requires no data, and no sample is looked at until an NDA covering confidentiality, permitted use, retention and security has been signed. The contract governs scope, permitted use, transfer and processing, and professional anonymization with purpose-built tools detects and removes or replaces sensitive information before further use. You decide what is in scope, and sources such as non-clinical operational records, IT tickets or software code may be simpler starting points than clinical data.

This guide is general information, not legal advice. HIPAA compliance depends on your role, your data and your agreements. Consult a qualified healthcare privacy lawyer and your privacy officer before sharing any health data.