HIPAA Compliance for Modern Infrastructure

De-identification and Data Minimization: Satisfying 45 CFR §164.502 and 45 CFR §164.514 doesn't mean shutting off access to the data you need.

What is HIPAA?

The Health Insurance Portability and Accountability Act 1996, also known as HIPAA, is a US federal law designed to “protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.”

Protected health information (PHI) is subject to tougher privacy rules than most datasets.

Data controllers that store, share, or use these datasets, including healthcare providers and business associates, must demonstrate they use the “minimum necessary” for an intended use, disclosure, or request. As laid out by the HIPAA Privacy Rule, the use and disclosure of PHI must be properly managed and protected while maintaining individual privacy. For use cases that don't require PHI, such as development or testing, high quality de-identified data becomes an important asset for engineers and analysts alike.

Why does HIPAA matter?

HIPAA, and similar regulations worldwide, have been implemented to reduce the risk of data breaches including sensitive information. They hold organizations to account and, should a business wish to hold personally identifiable data, they must adhere to specific security standards including technical controls.

HIPAA creates a minimum level of control and security, on the federal scale, that organizations must remain compliant with if they hold or use PHI. Also, the law empowers individuals to have more control over their personal, sensitive data and how it is used. Organizations failing to adhere to HIPAA privacy and security rules are subject to significant fines, or worse, expose themselves to the risk of a data breach putting the viability of the company at risk.

How Privacy Dynamics can help

The most effective approach to complying with HIPAA is to de-identify data containing PHI. HIPAA provides flexibility in the methods organizations can use to remove personal identifiers and the experts at Privacy Dynamics would be pleased to assist you on this journey.

Privacy Dynamics solutions harness automation by automatically masking, redacting, tokenizing, or replacing direct identifiers. Our algorithms are also able to configure treatment plans to address indirect identifiers such as date of birth, gender, and zip code. Projects can be scheduled, when appropriate, before writing the de-identified data to a destination database.

This process satisfies two key pieces of HIPAA compliance, 45 CFR §164.502 and 45 CFR §164.514, while maintaining the maximum allowable utility of the de-identified data.