Sources / Press and newsletters

HHS OCR guidance on de-identification (2012): who is an expert, United States (federal)

14 records were read from this source, dated 17 Oct 2026.

Its permanent copy is being made in the Wayback Machine.

Last checked 17 Oct 2026

What was read from it

Records read from this source
Record	Kind	As stated	Dated
HHS OCR guidance on de-identification (2012): who is an expert (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.2)	Law or ruling	No licence makes someone an expert; OCR looks at the person's training and actual…	17 Oct 2026
HHS OCR guidance on de-identification (2012): how an expert works (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)	Law or ruling	An expert assesses the risk for the anticipated recipients, recommends transformations,…	17 Oct 2026
HHS OCR guidance on de-identification (2012): no fixed numerical risk level (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.3)	Law or ruling	HHS sets no single number for very small risk: the expert sets it for the recipient and…	17 Oct 2026
HHS OCR guidance on de-identification (2012): methods and results documented (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)	Law or ruling	The expert's report is the evidence: it must exist and be produced to the regulator on…	17 Oct 2026
HHS OCR guidance on de-identification (2012): time-limited determinations (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.4)	Law or ruling	Expert determinations often carry an expiry, because what counts as reasonably available…	17 Oct 2026
HHS OCR guidance on de-identification (2012): what actual knowledge means (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.6)	Law or ruling	Actual knowledge is clear and direct knowledge, such as a record naming a patient's…	17 Oct 2026
HHS OCR guidance on de-identification (2012): identifiers in free text (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.10)	Law or ruling	Notes, narratives and comment fields get no exemption: a name or date in prose must go…	17 Oct 2026
HHS OCR guidance on de-identification (2012): hashed codes (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.5)	Law or ruling	A plain hash of a patient identifier is itself an identifier under Safe Harbor; only a…	17 Oct 2026
HHS OCR guidance on de-identification (2012): data use agreements for de-identified data (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.9)	Law or ruling	HIPAA does not require a contract for de-identified data, but a holder may and usually…	17 Oct 2026
HHS OCR guidance on de-identification (2012): whose names must go (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.8)	Law or ruling	Safe Harbor does not itself require removing clinicians' or staff names, though other…	17 Oct 2026
HHS OCR guidance on de-identification (2012): the restricted three-digit ZIP codes (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.1)	Law or ruling	HHS lists the three-digit ZIP prefixes that must become 000 (from 2000 Census data) and…	17 Oct 2026
HHS OCR guidance on de-identification (2012): dates under Safe Harbor (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.3)	Law or ruling	Under Safe Harbor a date of service, a lab date or a ticket date tied to a patient keeps…	17 Oct 2026
HHS OCR guidance on de-identification (2012): how an expert lowers the risk (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.8)	Law or ruling	An expert removes (suppresses), coarsens (generalises) or perturbs values until the risk…	17 Oct 2026
HHS OCR guidance on de-identification (2012): several releases and combination risk (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.5)	Law or ruling	Releases cut differently for different recipients must not combine to identify anyone,…	17 Oct 2026

HHS OCR guidance on de-identification (2012): who is an expert (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.2)
Kind
Law or ruling
As stated
No licence makes someone an expert; OCR looks at the person's training and actual…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): how an expert works (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)
Kind
Law or ruling
As stated
An expert assesses the risk for the anticipated recipients, recommends transformations,…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): no fixed numerical risk level (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.3)
Kind
Law or ruling
As stated
HHS sets no single number for very small risk: the expert sets it for the recipient and…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): methods and results documented (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.6)
Kind
Law or ruling
As stated
The expert's report is the evidence: it must exist and be produced to the regulator on…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): time-limited determinations (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.4)
Kind
Law or ruling
As stated
Expert determinations often carry an expiry, because what counts as reasonably available…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): what actual knowledge means (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.6)
Kind
Law or ruling
As stated
Actual knowledge is clear and direct knowledge, such as a record naming a patient's…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): identifiers in free text (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.10)
Kind
Law or ruling
As stated
Notes, narratives and comment fields get no exemption: a name or date in prose must go…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): hashed codes (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.5)
Kind
Law or ruling
As stated
A plain hash of a patient identifier is itself an identifier under Safe Harbor; only a…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): data use agreements for de-identified data (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.9)
Kind
Law or ruling
As stated
HIPAA does not require a contract for de-identified data, but a holder may and usually…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): whose names must go (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.8)
Kind
Law or ruling
As stated
Safe Harbor does not itself require removing clinicians' or staff names, though other…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): the restricted three-digit ZIP codes (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.1)
Kind
Law or ruling
As stated
HHS lists the three-digit ZIP prefixes that must become 000 (from 2000 Census data) and…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): dates under Safe Harbor (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 3.3)
Kind
Law or ruling
As stated
Under Safe Harbor a date of service, a lab date or a ticket date tied to a patient keeps…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): how an expert lowers the risk (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.8)
Kind
Law or ruling
As stated
An expert removes (suppresses), coarsens (generalises) or perturbs values until the risk…
Dated
17 Oct 2026
HHS OCR guidance on de-identification (2012): several releases and combination risk (HHS OCR, Guidance Regarding Methods for De-identification of PHI, 26 November 2012, section 2.5)
Kind
Law or ruling
As stated
Releases cut differently for different recipients must not combine to identify anyone,…
Dated
17 Oct 2026