Governing PHI: HIPAA, de-identification, and breach exposure

# Governing PHI: HIPAA, de-identification, and breach exposure

A marketing analyst emails your data team: "Can I get the diabetes patient list with names, zip codes, and admission dates? I want to target a wellness campaign." It sounds harmless. It is also a potential HIPAA violation that could cost your hospital millions and trigger federal reporting.

Knowing why that request fails, and how to reshape it into something legal, is the core skill of this lesson.

The rules that govern the data

PHI (Protected Health Information) is any health information that can be tied to an individual and is held by a covered entity. That includes diagnoses, lab results, admission dates, and even the fact that someone is a patient at all.

HIPAA (Health Insurance Portability and Accountability Act) is the 1996 US law that sets the baseline rules for handling PHI. Two parts matter most for data work:

The Privacy Rule: governs when you may use or disclose PHI.
The Security Rule: governs how you protect electronic PHI (encryption, access controls, audit logs).

A covered entity is a hospital, clinic, health plan, or clearinghouse. A business associate is a vendor that handles PHI on the covered entity's behalf (a cloud analytics firm, a billing contractor). Business associates are bound by contract (a BAA, or Business Associate Agreement) and are directly liable under HIPAA.

The official source is the US Department of Health and Human Services. Their HIPAA for Professionals hub is the authoritative reference.

TPO: the uses that need no patient authorization

HIPAA permits PHI use without patient sign-off for three purposes, known as TPO (Treatment, Payment, and Operations).

Treatment. Sharing PHI to care for the patient. A cardiologist pulls the ER's notes on the same patient. Fully permitted.

Payment. Billing and reimbursement. Sending diagnosis codes to an insurer to get a claim paid. Permitted.

Operations. Running the hospital: quality improvement, care coordination, credentialing, internal audits, training. A team analyzing readmission rates to reduce them is operations. Permitted.

Everything outside TPO generally requires either patient authorization (a signed, specific consent) or de-identification (stripping the data so it is no longer PHI).

Back to the marketing request

Marketing to sell an unrelated wellness product is not TPO. Under the Privacy Rule, most marketing that uses PHI requires patient authorization. So the analyst's request as written is a violation.

But there are legal paths:

Reshape it as operations. If the "campaign" is really a care management program to help existing diabetic patients manage their condition, some of it may qualify as healthcare operations. This depends on specifics and legal review, not your say-so.
De-identify the data. If the analyst only needs population patterns (how many diabetic patients by region), give them de-identified data. Then HIPAA no longer applies.

The lesson: the same underlying data can be legal or illegal depending on purpose and identifiability.

The Safe Harbor de-identification standard

HIPAA gives two ways to de-identify. Expert Determination uses a qualified statistician to certify low re-identification risk. Most data teams use the simpler Safe Harbor method: remove 18 specific identifiers, and the data is no longer PHI.

Here are the 18 Safe Harbor identifiers you must strip:

1. Names

2. Geographic subdivisions smaller than a state (street, city, county, and most zip codes)

3. All date elements more specific than a year (birth date, admission date, discharge date)

4. Telephone numbers

5. Fax numbers

6. Email addresses

7. Social Security numbers

8. Medical record numbers

9. Health plan beneficiary numbers

10. Account numbers

11. Certificate or license numbers

12. Vehicle identifiers and license plates

13. Device identifiers and serial numbers

14. Web URLs

15. IP addresses

16. Biometric identifiers (fingerprints, voiceprints)

17. Full-face photos and comparable images

18. Any other unique identifying number, characteristic, or code

Two nuances trip people up:

Zip codes. You may keep the first three digits, but only if that geographic unit contains more than 20,000 people. For sparse three-digit zones, you must set those digits to 000.
Ages 90 and over. Must be grouped into a single "90+" category, because very old ages are rare enough to identify someone.

The full rule and both methods are documented in the HHS de-identification guidance.

Applying Safe Harbor to the request

The analyst wanted names, zip codes, and admission dates. All three are Safe Harbor identifiers. Watch what a compliant transformation looks like:

python

import pandas as pd

# Raw PHI extract (never leaves the secure zone in this form)
df = pd.read_csv("diabetic_patients.csv")

# Safe Harbor transformations
df = df.drop(columns=["name", "mrn", "phone", "email", "ssn"])

# Keep only 3-digit zip; blank out low-population prefixes
sparse = {"036", "059", "063", "102", "203", "556",
          "692", "790", "821", "823", "830", "831",
          "878", "879", "884", "890", "893"}
df["zip3"] = df["zip"].astype(str).str[:3]
df["zip3"] = df["zip3"].where(~df["zip3"].isin(sparse), "000")
df = df.drop(columns=["zip"])

# Dates to year only
df["admit_year"] = pd.to_datetime(df["admit_date"]).dt.year
df = df.drop(columns=["admit_date"])

# Ages 90+ collapsed
df["age"] = df["age"].clip(upper=90)

df.to_csv("diabetic_deidentified.csv", index=False)

Now the analyst gets regional diabetes counts by year with no way to single out a patient. HIPAA no longer applies to this file. The campaign question becomes a marketing strategy problem, not a compliance one.

A middle path also exists: a Limited Data Set, which may keep dates and partial geography for research, public health, or operations, but only under a signed Data Use Agreement. It is not de-identified, so it remains PHI with restrictions.

Breach exposure: what happens when it goes wrong

A breach is an unauthorized acquisition, access, use, or disclosure of PHI. Under the Breach Notification Rule, a covered entity generally must:

Notify affected individuals without unreasonable delay, and no later than 60 days after discovery.
Notify HHS.
Notify the media if the breach affects 500 or more residents of a state or jurisdiction.

Large breaches are posted publicly on the HHS enforcement portal, informally called the "Wall of Shame." A ransomware attack that encrypts PHI is presumed to be a breach unless you can demonstrate low probability of compromise through a formal risk assessment.

Penalties scale with culpability, from unknowing violations to willful neglect, and can reach into the millions of dollars per year for repeated violations of the same provision. Beyond fines, breaches bring reputational damage and lost patient trust, which are often the larger cost.

The most common real-world triggers are mundane: a lost laptop without encryption, an emailed spreadsheet to the wrong recipient, or a database with PHI left accessible to an over-broad set of staff. Good governance is boring on purpose.

Vérification des acquis

1. A marketing analyst requests a patient list with names, zip codes, and admission dates for a wellness campaign. Why does this request fail under HIPAA as described?

2. What best distinguishes the HIPAA Privacy Rule from the Security Rule?

3. A cloud analytics firm processes patient data on behalf of a hospital. Which statement correctly describes its HIPAA status?

CHOIX MULTIPLES

4. Select ALL correct answers about what qualifies as PHI when held by a covered entity.

Sélectionnez toutes les réponses correctes.

CHOIX MULTIPLES

5. Select ALL correct answers about the TPO purposes that permit PHI use without patient authorization.

Sélectionnez toutes les réponses correctes.

Building the governance habit

The technical steps only work inside a governed process. Three practices separate mature data teams from exposed ones.

Minimum necessary. For any non-TPO use, share only the data required for the task. The analyst wanted names; they needed counts. Default to less.

Role-based access and audit logs. Restrict who can query raw PHI, and log every access. If a breach investigation happens, you must show who touched what.

A request intake gate. Every data request should answer three questions before fulfillment: What is the purpose? Is it TPO? If not, is there authorization, or does it need de-identification? A short form catches the marketing request before it becomes an incident.

None of this is legal advice. When a request sits near the TPO boundary, route it to your privacy officer or counsel. The analyst's job is to recognize the boundary, not to rule on it alone.

Key Takeaways

PHI is identifiable health information. Once you truly de-identify it under Safe Harbor, HIPAA no longer applies.
TPO (Treatment, Payment, Operations) needs no authorization. Almost everything else, including most marketing, does.

Making systems talk: interoperability with FHIR and HIEs