Who is who under HIPAA#
A hospital or health plan is a covered entity. A firm that handles protected health information (PHI) on its behalf — including to train a model — is a business associate and must sign a business associate agreement (BAA) before receiving any PHI. The BAA limits use of the data to the contracted purpose: a vendor cannot reuse a client’s PHI, or a model trained on it, for other customers.
This page summarizes public guidance as we understand it in October 2026 to help technical and risk teams plan. Confirm obligations with your counsel and compliance function.
The two de-identification routes#
Data that is properly de-identified under 45 CFR §164.514(b) is no longer PHI and falls outside the Privacy Rule’s restrictions. There are two methods, and either may be used:
Safe Harbor#
Remove eighteen categories of identifiers about the individual and their relatives, employers and household members, and have no actual knowledge that the remainder could identify anyone:
- Names
- Geographic subdivisions smaller than a state (street, city, county, ZIP — the first three ZIP digits may stay if that area has more than 20,000 people)
- All elements of dates except year directly related to an individual (birth, admission, discharge, death); ages over 89 aggregated into 90+
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or licence numbers
- Vehicle identifiers and serial numbers, including licence plates
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers, including finger and voice prints
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic or code
Expert Determination#
A qualified statistical expert determines, and documents, that the risk of re-identification is very small, using accepted methods. This route can keep details Safe Harbor strips — full dates for longitudinal patterns, finer geography — which can matter for clinical tasks.
Why de-identifying clinical text is harder than tables#
Identifiers in notes are unstructured: “seen with her daughter Maria at the Elm St clinic on 3/14”. Rule-based scrubbers miss variants and over-redact clinical terms that look like names (eponymous diseases, drug names). Our pipeline combines pattern rules for structured identifiers, a named-entity model for names and locations, date shifting with a consistent per-patient offset (preserving intervals between events, which clinical tasks need), and human review of a sample with a measured miss rate. Under Expert Determination, that measured residual rate is part of the evidence.
Memorization: why it matters more for models#
Language models can memorize rare sequences in their training data and reproduce them when prompted, and fine-tuning on small datasets for many epochs increases the risk. A model trained on raw PHI is therefore itself a potential disclosure channel, which is the strongest argument for de-identifying before training rather than relying on output filters afterwards.
We test for it directly. Canary strings — synthetic identifiers inserted into a held-out copy of training data — measure whether a training recipe memorizes rare tokens. Extraction probes prompt the trained model with prefixes from training notes and check completions against the source. Both run in the evaluation suite as release gates (evaluating fine-tuned LLMs).
A reference architecture#
| Step | Where it runs | Control |
|---|---|---|
| Extract notes and labels | Covered entity | Minimum necessary fields only |
| De-identify (Safe Harbor or Expert Determination) | Covered entity | Measured residual identifier rate; expert sign-off where applicable |
| Annotation by clinicians | Covered entity tooling | Access logging; no export |
| Training and evaluation | Covered entity cloud account or on-prem GPUs | No data egress; BAA covers vendor engineers |
| Memorization and leakage tests | Covered entity | Release gate |
| Serving | Covered entity | Audit logging of inputs and outputs |
Training compute for this kind of model is modest — a 7B model fine-tuned on tens of millions of tokens is a few GPU-hours (compute model) — so running it inside the covered entity’s environment is rarely a cost problem.
References#
- US Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule.
- 45 CFR §164.514(a)–(b), Other requirements relating to uses and disclosures of protected health information.