How HIPAA expert determination works: process, report and experts

What is HIPAA expert determination?

Expert determination is one of two ways to de-identify health information under the HIPAA Privacy Rule. A qualified expert applies statistical and scientific principles, concludes that the risk of identifying anyone is very small, and documents the methods and results. The other method, Safe Harbor, removes 18 listed identifiers and requires no actual knowledge that what remains could identify a person.

HHS describes both in its de-identification guidance, and says health information de-identified by either method is no longer protected health information under the Privacy Rule. This is general information, not legal, tax or financial advice. Confirm with your own counsel or privacy officer before acting.

When does an owner need it?

Most operating records do not need it. Expert determination matters when a company's data includes health information that comes within HIPAA and the company wants to license a de-identified version. The usual signal is free text, dates and combinations of fields that Safe Harbor's rigid list cannot handle without destroying the data's usefulness.

A company that mainly holds protected health information without authorization or de-identification is a red flag for SourceX. A healthcare administration business whose valuable records are non-PHI operating material may still fit.

The process, step by step

The steps below follow the general pattern described in HHS guidance. Experts and engagements vary, so treat the order as typical, not required.

1. Scope the dataset. The company defines which systems, fields and time periods are in, who will receive the data and under what controls. A narrower, clearer scope makes the analysis cheaper and faster.
2. Select a qualified expert. HHS describes an expert as a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles for rendering information not individually identifiable. There is no single government certification; the company should ask about training, prior work and independence.
3. Analyze identifiers and quasi-identifiers. The expert looks at direct identifiers and at combinations such as dates, geography, rare conditions and job titles that could single someone out. The page on quasi-identifiers and re-identification risk explains the idea.
4. Choose transformations. Generalizing dates, coarsening locations, suppressing rare values, and scrubbing free text are typical tools. Free text is the hard part; see de-identifying free text such as emails, notes and tickets.
5. Assess the risk threshold. The expert judges whether, given the recipient and the anticipated environment, the risk is very small. HHS does not set a numeric threshold.
6. Document the rationale. The written determination records the methods and results that support the conclusion.
7. Apply controls and set a review point. Experts often tie their conclusion to conditions, such as no linkage with other datasets, and to a time after which the analysis should be revisited.

What the written report usually contains

Contract terms often back this up. The page on no-re-identification clauses covers who carries liability after delivery.

How long does it take and what does it cost?

There is no standard price or timeline. Scope, data size, the amount of free text and the expert's workload drive both, so ask for a written estimate that names what is and is not included. Plan for iteration, because the first analysis often leads to additional generalization and a second pass.

Expert determination vs Safe Harbor

Illustrative example

Illustrative and fictional: a 200-person revenue-cycle services firm wants to license ten years of internal workflow records. Its operating tickets mention appointment dates, clinic names and short notes. The firm excludes claims files and clinical documents outright, then asks an expert to assess the ticket set. The expert recommends shifting dates to months, replacing clinic names with region codes, dropping free-text notes longer than a set length, and prohibiting linkage in the license. The written determination ties its conclusion to those conditions and a review date.

The dataset is thinner than the raw archive, but the firm can show a buyer exactly what was assessed and why the remaining risk was judged very small.

What this means for a referral partner

Partners do not assess data and never export, upload or describe confidential records. If a prospect says its records involve patients, ask one question: are the valuable records administrative and operational, or clinical? Operational material may fit. Clinical records belong with the company's privacy officer and counsel. The healthcare contact center recordings guide shows an example of how recordings complicate this, and the page on personal emails in work mailboxes covers a neighboring issue. California's separate definition is in the guide to three commitments for de-identified data.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; no reward is guaranteed.

Who should be in the room?

The company's privacy officer or counsel should own the engagement, with an IT lead who can run exports and a business owner who understands which fields matter. The buyer's reviewer may later ask to read the determination, so write it for an outside reader and keep the working notes organized.

Questions to ask an expert before hiring

• Have you de-identified free-text business records, not only structured claims or clinical data?
• What conditions will your determination depend on?
• How do you treat the recipient's environment in your risk assessment?
• What will you deliver, and when should the analysis be revisited?
• Are you independent of the company and the buyer?

Next step

Run a preliminary screen with the company fit checker and read how the process works. If you know a US company with 50+ full-time employees at peak (contractors excluded) whose valuable records are operational, register as a partner and make the introduction.