Quick answer
Begin with the analytic question and minimum useful fields. Choose a legally supported release route before sending data: HIPAA de-identification requires Safe Harbor or a documented Expert Determination, while a limited data set remains PHI and requires the applicable purpose and data use agreement. Removing names or hashing resident IDs does not by itself settle the question.
Start with what the analysis needs to calculate
A hospital partner asks for resident-level admission and discharge dates to study transition delays. The SNF removes names, calls the file anonymous and uploads it. That conclusion does not follow from the transformation: dates, identifiers embedded in narrative text and rare combinations of facts may still matter.
HHS de-identification guidance explains two HIPAA methods: Safe Harbor and Expert Determination. 45 CFR 164.514 separately governs limited data sets. Treat these as different release designs with different evidence, not interchangeable export checkboxes.
Write the question first: “Estimate the distribution of elapsed days between referral receipt and admission for a defined cohort.” Then ask whether the receiver needs actual dates, resident-level intervals, aggregate counts or identified follow-up. Each choice changes the utility and the disclosure analysis.
Compare three concrete release designs
| Proposed design | Utility retained | Review needed before release |
|---|---|---|
| Aggregate interval distribution | Overall delay pattern; little individual follow-up | Assess small cells, unusual combinations and whether the result is appropriately de-identified |
| Resident-level data under Safe Harbor | Variables remaining after the required removals | All applicable identifier categories, age/date handling, free text and actual-knowledge condition |
| Limited data set with necessary dates | Temporal analysis at individual-record level | Excluded direct identifiers, permitted research/public-health/operations purpose and qualifying data use agreement |
An Expert Determination is another possible route when the desired utility requires a different transformation. It requires an appropriately qualified expert's assessment and documented methods/results concerning the very small identification risk for the anticipated recipient. A supplier's statement that it “uses statistical anonymization” is not the determination itself.
Safe Harbor is more than deleting a name column. Its date rules generally remove elements other than year for dates directly related to an individual, and its age rules require attention to ages over 89. Geographic and other identifiers have their own conditions. Review narrative fields, filenames and embedded document properties as well as structured columns.
Test utility and disclosure risk together
In an original synthetic exercise, six referrals have delays of 0, 1, 1, 2, 4 and 10 days. A recipient can calculate a median of 1.5 days from those intervals without receiving calendar dates. Whether that interval-only release is appropriately de-identified still requires the chosen method's assessment; useful arithmetic is not a privacy determination.
Now suppose the recipient wants to compare delays during a specific hospital closure. The dates may become analytically important. That is a reason to revisit the release route and authorization, not quietly add dates back into a file previously reviewed under another design.
Require a field manifest showing business purpose, source, transformation, inclusion decision and validation. Use synthetic text containing a name, record number and exact date to test whether a proposed free-text process actually removes them. A single successful example does not validate all narrative processing, so document residual uncertainty and sample strategy.
Make the agreement match the data
A limited data set remains PHI. The rule limits its use to research, public health or health care operations and specifies data use agreement conditions, including permitted recipients and uses, safeguards, reporting of impermissible use, downstream restrictions and prohibitions on identifying or contacting individuals. A generic confidentiality clause may not supply these terms. Qualified reviewers should assess the actual purpose, parties and arrangement.
For any approved release, retain the specification, reviewed legal route, dataset version, validation evidence, recipient and transfer record. Control later changes: a new recipient, linkage source, added field or new purpose may invalidate the earlier assessment. A recurring feed should stop for review when its schema expands, rather than inheriting approval from a narrower first file.
The purchasing decision is whether the platform can reproducibly create and document the approved release. It should support the chosen transformations and reconciliation without claiming that every exported dataset is anonymous.
Questions & answers
Can a limited data set contain admission dates?
The limited-data-set exclusions differ from Safe Harbor and can permit dates. The data remains PHI, and the permitted-purpose and data-use-agreement conditions still apply.
Does a hashed identifier make an export anonymous?
No. The entire dataset, transformation and ability to identify an individual must be assessed under the chosen route. Other fields and free text can remain identifying.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.