Treat health-related content as a separate scope
Health information can appear in obvious clinical records and in less obvious places: customer tickets, employee messages, benefit documents, recordings, and app feedback. Do not mix these records into a general business dataset by default. Identify the sources and pause their inclusion while an appropriate reviewer evaluates the proposed use.
This guide is a preparation checklist, not a legal determination or a de-identification procedure. A qualified privacy and legal team should assess the organizations involved, applicable laws, contractual duties, and intended recipients before any sample is shared.
Use the correct framework
HHS describes two HIPAA de-identification methods: Expert Determination and Safe Harbor. These have specific requirements; merely removing names is not equivalent to completing either method. Whether HIPAA applies is itself a separate question about the entities, information, and circumstances.
Do not infer that data outside HIPAA is unrestricted. Ask reviewers to consider other privacy rules, consent language, confidentiality commitments, and source contracts. Keep the underlying legal analysis distinct from a technical tool’s report that selected identifier patterns were removed.
Prepare evidence without disclosing records
Create a source inventory, data dictionary, collection-purpose summary, and description of the buyer’s intended use. Document where direct identifiers, dates, geographic details, images, free text, and linked records appear. This lets specialists assess the work before receiving a large uncontrolled archive.
Ask how rare events, longitudinal sequences, and external linkage affect risk. If records include images or recordings, inspect identifying information within the content as well as metadata. Plan quality checks for the transformed version and a process for handling an overlooked identifier.
- Keep health-related records out of ordinary sales samples.
- Separate authority to de-identify from authority to reuse.
- Review the actual recipient and proposed downstream use.
Decide whether the project is proportionate
Estimate the cost of expert review, documentation, transformation, testing, and continuing obligations. Determine whether the buyer’s task survives the necessary reductions. A collection that loses essential context may no longer support the stated purpose, even if considerable cleanup work has been performed.
If the required authority or safeguards cannot be established, stop that part of the project. Consider a different, appropriately sourced collection rather than improvising a shortcut. Never describe a dataset as HIPAA compliant or anonymous based solely on an automated redaction pass or a general-purpose checklist.
Common questions
Does HIPAA cover all health information?
Do not assume that it does. Applicability depends on the specific entities and circumstances, and other requirements can apply even when HIPAA does not.
Can a vendor de-identify customer health records for its own sale?
That requires a specific review of authority, contracts, and applicable law. Access to records for providing a service does not establish permission for an independent licensing business.