What De-Identified Actually Means

Answer first: it is a defined term, not a description

When a health company says data is de-identified, it is usually pointing at a legal standard rather than describing a state of affairs.

The federal health privacy rules set out one standard. Two state privacy statutes set out another, close in wording and different in structure.

None of them promises that a person cannot be recognized. They set tests, and a test is passed by doing specified things, not by achieving anonymity.

That distinction is the whole subject. The rest of this explains what each test asks for and what each one leaves alone.

The federal standard, and the two ways to meet it

The federal regulation states the standard first. Health information that does not identify an individual, and about which there is no reasonable basis to believe the information can be used to identify an individual, is not individually identifiable health information.

It then says a covered entity may determine that information meets that standard only in one of two ways.

The first is an expert determination. A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles applies those methods. That person determines that the risk is very small that the information could be used to identify an individual. The judgment covers use alone or in combination with other reasonably available information, by an anticipated recipient.

That person also has to document the methods and results of the analysis that justify the determination.

Notice how much of that sentence is about circumstances rather than about the data. The risk is judged against other reasonably available information and against an anticipated recipient. Change the recipient and you have changed the question.

The second way is a list, and the list is the education

The alternative method removes eighteen categories of identifiers, of the individual and of relatives, employers and household members.

Names. All geographic subdivisions smaller than a state, including street address, city, county, precinct and zip code. There is a narrow exception for the first three digits of a zip code, where the area those digits cover holds more than twenty thousand people.

All elements of dates except year for dates directly related to an individual, including birth date, admission date, discharge date and date of death. All ages over eighty-nine, which the regulation allows to be collapsed into a single category.

Telephone numbers, fax numbers, email addresses, social security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate and license numbers.

Vehicle identifiers and serial numbers. Device identifiers and serial numbers. Web addresses. Internet protocol address numbers. Biometric identifiers including finger and voice prints. Full face photographic images and comparable images.

And then the catch-all that carries the weight: any other unique identifying number, characteristic or code, except a re-identification code permitted by the section's own next paragraph.

The method has a second half that is easy to miss. Removing the list is not enough on its own. The entity must also not have actual knowledge that the remaining information could be used, alone or in combination with other information, to identify an individual.

The holder may keep the key

The same section permits a covered entity to assign a code or other means of record identification so that de-identified information can be re-identified by that entity later.

Two conditions attach. The code must not be derived from or related to information about the individual, and must not otherwise be capable of being translated so as to identify the individual.

And the entity must not use or disclose the code for any other purpose, and must not disclose the mechanism for re-identification.

So under the federal rule, de-identified is compatible with the holder being able to put the name back. What the rule restricts is who else can do it and what the code may be used for.

A limited data set is a different thing with a similar sound

The same regulation defines a limited data set, and the definition begins by saying what it is. A limited data set is protected health information that excludes a list of direct identifiers.

That opening clause is the point. A limited data set has not left the rulebook. It is still protected health information, and it may be used or disclosed only where the entity enters into a data use agreement with the recipient.

Its exclusion list is also shorter than the de-identification list. It removes names, most address information other than town or city, state and zip code, and telephone and fax numbers. Email addresses, social security numbers, record and beneficiary and account numbers, and certificate and license numbers come out too. So do vehicle and device identifiers, web addresses, internet protocol addresses and biometric identifiers.

Dates survive it. So does the three-digit-plus zip code. A dataset described as stripped of direct identifiers may be this, and this is not de-identification.

The consumer-law version, and the part that is a promise

California's consumer privacy statute defines deidentified as information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided that the business that possesses it does three things.

It takes reasonable measures to ensure the information cannot be associated with a consumer or household.

It publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify it, with one narrow exception. The business may attempt re-identification solely to determine whether its own deidentification process satisfies the requirement.

And it contractually obligates any recipients of the information to comply with all of those provisions.

Washington's health data statute uses the same three-part structure and adds one word. Its definition asks whether the data can reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable consumer, or a device linked to such a consumer.

Read the three conditions together and the shape becomes clear. One is a technical measure. The other two are a public commitment and a contract term, which means a good part of the definition is satisfied by what a company undertakes rather than by what the data is.

Why the classification changes which rulebook applies

This is not a labeling exercise. Meeting one of these definitions moves information out of a regime.

The Washington act states plainly that personal information does not include deidentified data, and its definition of consumer health data is built on personal information.

The same act's exemption section goes further in one direction. It does not apply to information that is deidentified in accordance with the requirements set out in the federal privacy regulations and that is derived from the health-care information the exemption section lists.

It also carves out information that is part of a limited data set and is used, disclosed and maintained in the manner the federal limited data set provision requires. That is a rare instance of one statute borrowing another's machinery by name.

So a determination made under a federal method can decide whether a state statute reaches the same records. The methods are not interchangeable, but the outcomes connect.

What a reader can and cannot verify

You can read whether a policy uses the word at all, and whether it says which standard it means.

You can look for the public commitment the consumer statutes require. That commitment is meant to be public, so its absence from a published document is something you can notice.

You can check whether the policy says anything about obligating recipients, since the third condition in both consumer definitions is a contract term imposed on whoever receives the data.

You cannot verify the technical measures. Neither can you verify an expert determination, which is documented internally and is a judgment about risk rather than a certificate.

And you cannot tell from outside which dataset a sentence refers to. A single policy can describe an identified record, a limited data set and a de-identified extract in three consecutive paragraphs without saying which is which.

What this does not decide

It does not say that any company's de-identification is adequate or inadequate. That is an assessment of specific data and specific methods, and nothing here reaches it.

It does not say that de-identified information has been re-identified in this market. No such claim is made and none is implied.

It does not describe the standards in any state other than the two named, and other states define the term differently.

And it is not legal advice. It reports what one federal section and two state definitions say.