HIPAA Privacy Rule: uses and disclosures of de-identified information (45 CFR 164.502(d))
Properly de-identified data falls outside the Privacy Rule, but handing over the re-identification key is a disclosure of protected health information, and re-identified data is protected again.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“The requirements of this subpart do not apply to information that has been de-identified in accordance with the applicable requirements of § 164.514, provided that: (i) Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identified information to be re-identified constitutes disclosure of protected health information; and (ii) If de-identified information is re-identified, a covered entity may use or disclose such re-identified information only as permitted or required by this subpart.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides