Part 2 paper-record de-identification

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.16(a)(1)(i)(E) requires formal policies and procedures for rendering paper patient-identifying information de-identified under 45 CFR 164.514(b) so there is no reasonable basis to believe the information can identify a particular patient. That incorporated section provides Expert Determination and Safe Harbor routes. The HHS fact sheet identifies February 16, 2026 as the compliance date for the amended Part 2 framework.

The incorporated standard controls

Current 42 CFR 2.16 directs anyone de-identifying paper records to 45 CFR 164.514(b). That section supplies two routes: a documented qualified-expert determination of very small identification risk or Safe Harbor removal of specified identifiers plus no actual knowledge that the remainder identifies the person.

Paper can hide identifiers

Review cover sheets, labels, tabs, handwriting, signatures, dates, locations, rare events, photographs, barcodes, QR codes, envelopes, sticky notes, fax headers, printer marks, and linked indexes. Scan-derived files require separate electronic review.

Control the release

Record source, purpose, method, reviewer, identifier checklist or expert report, actual-knowledge review, residual-risk limits, recipient, date, version, sample validation, approval, and corrective action. Other laws and contracts may still restrict the data.

Inventory the complete paper package

Identify the authoritative record, every page, copy, cover, tab, label, envelope, photograph, image, handwritten note, signature, date, geography, employer, household or family reference, rare event, identifier, barcode, QR code, fax header, printer mark, and linked index. Include working copies, scanning batches, reviewer notes, and proposed release packaging.

Map paper to the electronic systems, logs, lookup tables, case numbers, and files that could reconnect it. A blacked-out name may remain legible under light or through the reverse side, and a replacement code can be identifying if the recipient can access the key.

Choose a complete HIPAA method

For Safe Harbor, use a current checklist covering every identifier specified by section 164.514(b)(2) for the individual and relevant relatives, household members, and employers, then document the required no-actual-knowledge conclusion. Removing a name, address, and record number is not the full method.

For Expert Determination, verify the expert's appropriate knowledge and experience, the exact paper and linked data reviewed, anticipated recipient, reasonably available information, methods, very-small-risk conclusion, limitations, controls, and documented results. Do not reuse an opinion for a changed packet or recipient without confirming it still applies.

Produce and validate a controlled copy

Work from a protected source and create a version-locked release copy. Use a method that permanently removes or obscures the selected information on the released paper rather than a movable note or transparent mark. Inspect front, back, edges, attachments, images, and reproductions. Confirm page count and destroy rejected working copies securely.

Use a second reviewer or sampling plan proportionate to volume and risk. Test whether common searches, public facts, program context, dates, locations, rare traits, or linked materials could identify the patient. Record exceptions and corrections.

Review recipient and purpose before release

Document recipient identity, purpose, anticipated data access, other data the recipient holds, sharing plan, physical security, and restrictions. A packet that meets a method for one recipient or context may present different risk after public posting, broad distribution, or linkage with another source.

Release only the approved copy through a controlled channel. Preserve source, method, checklist or expert report, version, reviewers, validation, approval, recipient, date, and disclosure or release history. Reassess after any page, field, recipient, purpose, or external-data change.

Ask the final release questions

Confirm which method applies, who completed it, which paper and linked sources were reviewed, what the recipient already knows, whether any code can be reversed, which validation failed and was corrected, and whether every rejected copy was secured. Put the answers in the release record before the packet leaves controlled custody.

Example

Fourteen paper packets reach release review. Eleven include the approved method, every-page inspection, copy inventory, reviewer, validation, and approval; three retain identifying cover sheets. Readiness is 11 of 14 packets.

Paper de-identification checklist

• inventory every page, copy, cover, label, image, note, code, and linked index;
• select complete Safe Harbor or a documented qualified Expert Determination;
• create a permanent, version-locked release copy from the protected source;
• inspect both sides, attachments, reproductions, rare facts, and external linkage;
• verify recipient, purpose, other data, distribution, and release controls; and
• preserve method, review, validation, approval, release, and change history.

Redaction and de-identification are not synonyms. The released paper must satisfy the selected method as a complete data set in its anticipated context.