# Governing PHI: HIPAA, de-identification, and breach exposure
A marketing analyst emails your data team: "Can I get the diabetes patient list with names, zip codes, and admission dates? I want to target a wellness campaign." It sounds harmless. It is also a potential HIPAA violation that could cost your hospital millions and trigger federal reporting.
Knowing why that request fails, and how to reshape it into something legal, is the core skill of this lesson.
PHI (Protected Health Information) is any health information that can be tied to an individual and is held by a covered entity. That includes diagnoses, lab results, admission dates, and even the fact that someone is a patient at all.
HIPAA (Health Insurance Portability and Accountability Act) is the 1996 US law that sets the baseline rules for handling PHI. Two parts matter most for data work:
A covered entity is a hospital, clinic, health plan, or clearinghouse. A business associate is a vendor that handles PHI on the covered entity's behalf (a cloud analytics firm, a billing contractor). Business associates are bound by contract (a BAA, or Business Associate Agreement) and are directly liable under HIPAA.
The official source is the US Department of Health and Human Services. Their HIPAA for Professionals hub is the authoritative reference.
HIPAA permits PHI use without patient sign-off for three purposes, known as TPO (Treatment, Payment, and Operations).
Treatment. Sharing PHI to care for the patient. A cardiologist pulls the ERERThe ratio of interactions (likes, comments, shares) to reach for a given piece of content, used to gauge how well audiences respond relative to how many people saw it.View full definition →'s notes on the same patient. Fully permitted.
Payment. Billing and reimbursement. Sending diagnosis codes to an insurer to get a claim paid. Permitted.
Operations. Running the hospital: quality improvement, care coordination, credentialing, internal audits, training. A team analyzing readmission rates to reduce them is operations. Permitted.
Everything outside TPO generally requires either patient authorization (a signed, specific consent) or de-identification (stripping the data so it is no longer PHI).
Marketing to sell an unrelated wellness product is not TPO. Under the Privacy Rule, most marketing that uses PHI requires patient authorization. So the analyst's request as written is a violation.
But there are legal paths:
The lesson: the same underlying data can be legal or illegal depending on purpose and identifiability.
HIPAA gives two ways to de-identify. Expert Determination uses a qualified statistician to certify low re-identification risk. Most data teams use the simpler Safe Harbor method: remove 18 specific identifiers, and the data is no longer PHI.
Here are the 18 Safe Harbor identifiers you must strip:
1. Names
2. Geographic subdivisions smaller than a state (street, city, county, and most zip codes)
3. All date elements more specific than a year (birth date, admission date, discharge date)
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers and license plates
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers (fingerprints, voiceprints)
17. Full-face photos and comparable images
18. Any other unique identifying number, characteristic, or code
Two nuances trip people up:
The full rule and both methods are documented in the HHS de-identification guidance.
The analyst wanted names, zip codes, and admission dates. All three are Safe Harbor identifiers. Watch what a compliant transformation looks like:
import pandas as pd
# Raw PHI extract (never leaves the secure zone in this form)
df = pd.read_csv("diabetic_patients.csv")
# Safe Harbor transformations
df = df.drop(columns=["name", "mrn", "phone", "email", "ssn"])
# Keep only 3-digit zip; blank out low-population prefixes
sparse = {"036", "059", "063", "102", "203", "556",
"692", "790", "821", "823", "830", "831",
"878", "879", "884", "890", "893"}
df["zip3"] = df["zip"].astype(str).str[:3]
df["zip3"] = df["zip3"].where(~df["zip3"].isin(sparse), "000")
df = df.drop(columns=["zip"])
# Dates to year only
df["admit_year"] = pd.to_datetime(df["admit_date"]).dt.year
df = df.drop(columns=["admit_date"])
# Ages 90+ collapsed
df["age"] = df["age"].clip(upper=90)
df.to_csv("diabetic_deidentified.csv", index=False)Now the analyst gets regional diabetes counts by year with no way to single out a patient. HIPAA no longer applies to this file. The campaign question becomes a marketing strategy problem, not a compliance one.
A middle path also exists: a Limited Data Set, which may keep dates and partial geography for research, public health, or operations, but only under a signed Data Use Agreement. It is not de-identified, so it remains PHI with restrictions.
A breach is an unauthorized acquisition, access, use, or disclosure of PHI. Under the Breach Notification Rule, a covered entity generally must:
Large breaches are posted publicly on the HHS enforcement portal, informally called the "Wall of Shame." A ransomware attack that encrypts PHI is presumed to be a breach unless you can demonstrate low probability of compromise through a formal risk assessment.
Penalties scale with culpability, from unknowing violations to willful neglect, and can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → into the millions of dollars per year for repeated violations of the same provision. Beyond fines, breaches bring reputational damage and lost patient trust, which are often the larger cost.
The most common real-world triggers are mundane: a lost laptop without encryption, an emailed spreadsheet to the wrong recipient, or a database with PHI left accessible to an over-broad set of staff. Good governance is boring on purpose.
Knowledge check
1. A marketing analyst requests a patient list with names, zip codes, and admission dates for a wellness campaign. Why does this request fail under HIPAA as described?
2. What best distinguishes the HIPAA Privacy Rule from the Security Rule?
3. A cloud analytics firm processes patient data on behalf of a hospital. Which statement correctly describes its HIPAA status?
4. Select ALL correct answers about what qualifies as PHI when held by a covered entity.
Select all the correct answers.
5. Select ALL correct answers about the TPO purposes that permit PHI use without patient authorization.
Select all the correct answers.
The technical steps only work inside a governed process. Three practices separate mature data teams from exposed ones.
Minimum necessary. For any non-TPO use, share only the data required for the task. The analyst wanted names; they needed counts. Default to less.
Role-based access and audit logs. Restrict who can query raw PHI, and log every access. If a breach investigation happens, you must show who touched what.
A request intake gate. Every data request should answer three questions before fulfillment: What is the purpose? Is it TPO? If not, is there authorization, or does it need de-identification? A short form catches the marketing request before it becomes an incident.
None of this is legal advice. When a request sits near the TPO boundary, route it to your privacy officer or counsel. The analyst's job is to recognize the boundary, not to rule on it alone.