Part 2 public-health de-identification condition

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.54(b) requires the content disclosed for public health without consent to be de-identified under 45 CFR 164.514(b) so there is no reasonable basis to believe it can identify a patient. Section 164.514(b) describes expert determination and Safe Harbor. The method must be applied to the actual output, not merely to its source table.

Select and document one method

Current 45 CFR 164.514(b) provides the two HIPAA de-identification methods. Preserve the expert's qualifications, analysis, controls, and determination, or the Safe Harbor removal evidence plus the actual-knowledge assessment. A name-removal step alone is insufficient.

Apply the method to the release version

Record the source data, transformation code or procedure, exclusions, suppression, date handling, geography, free-text review, small-cell rules, linkage fields, output hash or version, reviewer, approval, and recipient. Re-run review after schema or logic changes.

Connect the result to Part 2

Current 42 CFR 2.54(b) requires de-identified content with no reasonable basis to believe it can identify a patient. Other state privacy, public-health, contract, research, security, and data-use rules may still govern the dataset.

Choose the method deliberately

For expert determination, use a person with appropriate knowledge and experience in accepted statistical and scientific de-identification principles. Preserve qualifications, anticipated recipients, reasonably available external information, methods, assumptions, risk analysis, controls, result, validity period, and documentation.

For Safe Harbor, remove the listed identifiers of the individual and relatives, employers, and household members and address the actual-knowledge condition. Obtain qualified review for the specific program, data, and cross-referenced requirements.

Transform every data surface

Inventory tables, fields, dates, geography, ages, identifiers, codes, narrative, images, audio, attachments, filenames, URLs, IP addresses, device values, metadata, audit logs, linkage keys, companion files, and derived outputs. Define removal, generalization, suppression, aggregation, masking, or other transformations and test them after joins and export.

Review small groups and rare combinations even when no direct identifier remains. A detailed treatment pattern, provider, date, and location can become identifying together.

Preserve reproducible evidence

Link source version, transformation code or procedure, parameters, execution log, quality checks, output hash or version, method documentation, reviewer, approval, recipient, and release. Protect this evidence because source samples and transformation logs may themselves contain patient-identifying information.

Use controlled code review, testing, change approval, and separation of source and release environments. Prevent users from exporting a pre-transformation table.

Test usability without restoring identity

Confirm that the public-health output remains accurate enough for its approved purpose after transformation. Check denominators, suppressed cells, date shifts, geographic aggregation, code mappings, missing values, and bias introduced by exclusions. Do not reintroduce identifying detail simply to make the dataset easier to analyze.

If the authority needs different detail, rerun the risk and method review on a new version or identify another supported legal pathway.

Reassess changes and failures

Trigger review for new fields, code, population size, rare events, geography, time granularity, recipient, purpose, access, external datasets, linkage methods, or public release. Define the expert determination's review horizon and Safe Harbor quality checks. Version each decision.

If identifying content leaves, contain the dataset, identify recipients and copies, preserve evidence, assess notification and reporting duties, issue a corrected output where appropriate, repair the transformation, and test remediation.

Review the production pipeline

Treat scheduled extracts, manual spreadsheets, analyst notebooks, vendor jobs, dashboards, and application programming interfaces as separate release implementations even when they use the same method. Inventory credentials, source permissions, code versions, staging files, temporary storage, logs, and delivery folders. Make the final output subject to an automated identifier scan and a human or expert review appropriate to its risk.

Reconcile the number of approved outputs with files actually delivered. Remove stale copies and prevent a recipient from retrieving an earlier, more detailed version after a replacement. A well-documented method can still fail through the wrong file selection or delivery path.

Example

Twelve export templates are due for review. Nine have a documented method, current transformation, actual output test, change trigger, approval, and recipient map; three rely on removing names. Method readiness is 9 of 12 templates.

De-identification checklist

• select expert determination or Safe Harbor with qualified oversight;
• inventory every direct, quasi, narrative, image, metadata, and linkage surface;
• apply transformations after joins and to the exact release output;
• preserve code, parameters, tests, output version, method evidence, and approval;
• validate public-health usefulness without restoring identifying detail; and
• reassess fields, populations, recipients, purposes, external data, and failures.

De-identification is a controlled production process. A label, removed name column, or earlier source review does not establish the release condition.