HIPAA de-identification for clinical research: Safe Harbor, Expert Determination and the options between

The HIPAA Privacy Rule applies to covered entities (health plans, clearinghouses and most providers) and their business associates. A hospital that shares data with a sponsor, or a university that releases a dataset to another group, needs either a permitted basis under the rule, such as an individual authorisation or a waiver of authorisation by an IRB or privacy board, or the data must be de-identified. Once data is properly de-identified under 164.514, it is no longer protected health information, and the Privacy Rule no longer restricts its use. That is why de-identification is the cleanest route for secondary analyses, data sharing with collaborators and publication of datasets.

It is also easy to get wrong. People assume that replacing a name with a code is enough, or that pseudonymised data under the GDPR is equivalent to HIPAA de-identified data. It is not. Our HIPAA versus GDPR guide sets out why the two tests differ, and authorization versus informed consent explains the other basis for using identifiable data. A sponsor that is not a covered entity may not be bound by HIPAA directly, but the sites that supply the data usually are, and the data arrives with their constraints. Whether HIPAA applies to your organisation is a question for your privacy officer.

Under 164.514(b)(2), the following identifiers of the individual or of relatives, employers or household members of the individual must be removed. The list below paraphrases the rule, so check the regulation text for the exact wording.

Under 164.514(b)(1), data can be treated as de-identified if a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable applies those methods and determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual. The expert must document the methods and the results of the analysis that justify the determination. The rule does not require a specific title, so a statistician is common but is not the only qualification the text allows.

In practice, Expert Determination suits cases where you need to keep dates, finer geography or rare clinical detail. The expert evaluates the data, the recipients, the release conditions and the other data they could combine it with, and may require transformations such as date shifting, generalisation or suppression, and conditions such as a data use agreement or no re-identification clause. The determination is specific to the dataset and the release: change the recipient or add a variable, and it may need to be revisited. HHS Office for Civil Rights has published guidance on both methods, and you should read the current version before you commission one.

Research data is normally coded. HIPAA allows a covered entity to assign a code that lets it re-identify the data later, and the code does not count as an identifier if two conditions in 164.514(c) are met. The code must not be derived from or related to information about the individual, for example it must not be built from initials, birth date or a medical record number. The covered entity also must not use or disclose the code or the mechanism for re-identification for any other purpose, and must not disclose the mechanism. A random study subject number that sits in a separate key held by the site meets the idea well. A hash of the record number does not.

This is where system design helps. If the platform separates identity from clinical data, the sponsor team can work from coded records while only the site holds the key. Capture works this way: site coordinators see participant names while researchers see coded IDs, and access is limited by role and by row-level security at the database layer. See data pseudonymisation in EDC for how to apply it. Remember that a coded dataset where the key still exists at the site is still PHI in the hands of the site until it is properly de-identified, so the code is a design control, not a legal conclusion.