HIPAA safe harbor vs expert determination: which fits business records?

Which HIPAA de-identification method fits business records?

Safe harbor fits records where identifiers sit in predictable fields and can be stripped cleanly; expert determination fits messy or free-text records where a qualified statistician must judge the remaining re-identification risk. Both are defined in 45 CFR 164.514(b), and HHS Office for Civil Rights guidance on de-identification explains that health information de-identified by either method is no longer protected health information under the Privacy Rule.

For a referral partner the practical point is narrow. Most companies SourceX works with are not healthcare providers, so HIPAA is not their main constraint. It becomes relevant when a company's records touch patient or member information: a billing outsourcer, a healthcare administration firm, a benefits broker or a practice-management software vendor. In those cases, the records cannot be licensed until one of these two methods, or another valid authorization, has been applied.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

How do the two methods compare side by side?

Safe harbor is a checklist; expert determination is an opinion. The table below sets them next to each other using the points HHS describes.

The "actual knowledge" clause deserves attention. If a billing manager knows that a rare diagnosis plus a small town points to one patient, stripping the listed fields does not satisfy the method.

What do the 18 identifiers look like in operational records?

The 18 HIPAA identifiers checklist for operational records walks through each one. In business systems they rarely appear only in a clean "patient name" column. Typical hiding places are:

• Support tickets and call notes where an agent types a member's name or phone number into a free-text field.
• Attachment file names such as scanned claim forms named after the person.
• Email signatures, subject lines and calendar invites that include appointment dates.
• Billing exports with account numbers, device serials or URLs embedded in comments.
• Screenshots and PDFs pasted into Slack or Teams threads.

This is why a column-level scrub is rarely enough for operational archives.

Which method fits which kind of record?

Match the method to the shape of the data rather than to a preference.

Many companies resolve this by scoping the dataset: leave out the patient-facing systems and license the procedural, financial-operations and internal-coordination records instead.

How does SourceX treat PHI-adjacent records?

Records that touch protected health information need either de-identification under one of the two methods or a valid HIPAA authorization before they belong in a licensed scope. Mainly-PHI datasets without that basis are a red flag for qualification, as are records belonging to a client of the company rather than the company itself.

Partners never handle the records. You do not export, upload or describe confidential content; you introduce the company and give basic fit information. Redaction and de-identification requirements are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. Nothing is binding until the company agrees price and terms and signs.

The company also needs its own counsel or compliance lead to confirm its position, especially if it is a business associate. The question of whether such a company may de-identify at all is covered in can a HIPAA business associate license de-identified data.

What should you ask the owner in the first conversation?

Use these as a short screen. They tell you whether HIPAA is a footnote or the main issue.

• Does the company serve healthcare providers, payers or patients directly?
• Do its systems hold names, dates of service or member numbers in free text?
• Does it act as a business associate under agreements with covered entities?
• Could the useful records be separated from the patient-facing ones?
• Has anyone at the company ever run a formal de-identification review?

Two or more "yes" answers on the first three lines means expect counsel and possibly an expert to be involved. Zero or one means the topic is probably manageable through scoping. The company fit checker gives a preliminary, non-binding screen without asking for contact details.

When is neither method the right answer?

Skip both methods and reconsider the introduction when the company's main asset is medical records or claims with no authorization route, or when a covered-entity client owns the data and has not consented. The broader legal picture is in is it legal for a company to license its business records for AI training, and the state-law angle in is licensing company records a sale under the CCPA.

Next step

If you know a US company with 50+ full-time employees at peak (contractors excluded), years of documented operations and an authorized sponsor, register as a partner and introduce it. Partners earn 25% of the eligible platform fees SourceX actually collects, capped at $100,000 cumulative per referred company, and only after the buyer pays and SourceX receives its fee. Rewards are not guaranteed. See how SourceX referrals work for the full process.