Privacy: HIPAA & De-identification

HIPAA protects PHI — health information plus identifiers. De-identification under Safe Harbor removes 18 identifier classes: names, dates more granular than year, ZIPs shorter than 3-digit aggregates, MRNs, device IDs, full-face photos, and more.

Dates are the sneaky one: 'admitted 2024-03-14' is PHI; under Safe Harbor all date elements finer than year must go. The alternative is Expert Determination — a qualified statistician certifies that re-identification risk is 'very small' given context. More data utility, more judgment calls, more documentation.