HIPAA Compliance – Expert Determination Aided by Private AI

Share This Post

In the contemporary landscape of health information technology, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule sets a national standard for the protection of individuals’ medical records and other protected health information (PHI). The HIPAA Privacy Rule allows for health information to be de-identified using two methods: the Safe Harbor method, which requires the removal of certain specified identifiers, and the Expert Determination method, where a qualified expert applies statistical or scientific principles to determine whether the risk is “very low” that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual.

We covered Safe Harbor compliance and how Private AI can help in a previous blog post and are now focusing on the role our technology can play in the expert’s determination of re-identification risks. For an informative resource covering the Expert Determination Rule front to back, clarifying questions such as who is an expert and what is “low risk” see here.

Expert Determination

Expert determination within the framework of HIPAA involves a rigorous process where a qualified expert deploys a variety of techniques to ensure the de-identification of PHI. These techniques include suppression, where specific information is omitted to prevent identification; generalization, which involves broadening or abstracting certain data elements (like age ranges or geographic locations) to make individual identification less likely; and perturbation, which introduces a controlled amount of random variation into the data to obscure original values while maintaining overall data utility. This process requires a deep understanding of both the data at hand and the broader data ecosystem. Meticulously documenting the process is also required.

The expert must keep abreast of the latest advancements in re-identification techniques and data science to anticipate how datasets could be combined with external information to re-identify individuals. Given the rapid development of technology and the increasing availability of data, experts may determine that a “low risk” of re-identification only exists for a limited amount of time, after which a re-assessment is necessary. 

How Private AI Can Help

Private AI’s technology becomes particularly advantageous when dealing with the complexities of free text data, such as clinicians’ notes, where PHI is not as straightforward to identify due to variations in language, terminology, and format. By employing sophisticated natural language processing algorithms, Private AI can discern and redact PHI from such unstructured text with a high degree of accuracy. This pre-processing is immensely beneficial to the expert determination process, as it clears the nebulous terrain of free text data, allowing the expert to apply their statistical and scientific principles to a dataset that has been efficiently sanitized of its most apparent identifiers. It is a supportive measure that enables experts to navigate the subtleties of risk assessment with more clarity, focusing their expertise on nuanced data relationships rather than overt data redaction.

The integration of such technology is also beneficial in processing data across multiple languages and formats, ensuring that de-identification efforts are thorough and consistent across diverse datasets, making de-identification more accurate and scalable at the same time. Yet, the final determination of re-identification risk remains a human-driven process that requires a deep understanding of the data’s potential use cases and the availability of other information that could lead to re-identification.

Conclusion

As we navigate the complexities of health data privacy, it is beneficial to be aware of the collaboration opportunities between technology and human expertise. De-identification technologies like those developed by Private AI are instrumental in the preliminary processing of data. They are a testament to the progress in the field of privacy-enhancing technology, yet they complement rather than replace the nuanced, expert-driven process required under the HIPAA Expert Determination method. The alliance of advanced AI tools and expert judgment forms the backbone of a robust approach to PHI de-identification and the protection of individual privacy.

Want to see our technology in action? Try our web demo or get an API key here.

Subscribe To Our Newsletter

Sign up for Private AI’s mailing list to stay up to date with more fresh content, upcoming events, company news, and more! 

More To Explore

Blog

Is Salesforce Law25 Compliant?

Although they hardly need an introduction, Salesforce is a cloud-based customer relationship management (CRM) service that allows businesses to efficiently connect with their customers, find

Read More »

Download the Free Report

Request an API Key

Fill out the form below and we’ll send you a free API key for 500 calls (approx. 50k words). No commitment, no credit card required!

Language Packs

Expand the categories below to see which languages are included within each language pack.
Note: English capabilities are automatically included within the Enterprise pricing tier. 

French
Spanish
Portuguese

Arabic
Hebrew
Persian (Farsi)
Swahili

French
German
Italian
Portuguese
Russian
Spanish
Ukrainian
Belarusian
Bulgarian
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
Greek
Hungarian
Icelandic
Latvian
Lithuanian
Luxembourgish
Polish
Romanian
Slovak
Slovenian
Swedish
Turkish

Hindi
Korean
Tagalog
Bengali
Burmese
Indonesian
Khmer
Japanese
Malay
Moldovan
Norwegian (Bokmål)
Punjabi
Tamil
Thai
Vietnamese
Mandarin (simplified)

Arabic
Belarusian
Bengali
Bulgarian
Burmese
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
French
German
Greek
Hebrew
Hindi
Hungarian
Icelandic
Indonesian
Italian
Japanese
Khmer
Korean
Latvian
Lithuanian
Luxembourgish
Malay
Mandarin (simplified)
Moldovan
Norwegian (Bokmål)
Persian (Farsi)
Polish
Portuguese
Punjabi
Romanian
Russian
Slovak
Slovenian
Spanish
Swahili
Swedish
Tagalog
Tamil
Thai
Turkish
Ukrainian
Vietnamese

Rappel

Testé sur un ensemble de données composé de données conversationnelles désordonnées contenant des informations de santé sensibles. Téléchargez notre livre blanc pour plus de détails, ainsi que nos performances en termes d’exactitude et de score F1, ou contactez-nous pour obtenir une copie du code d’évaluation.

99.5%+ Accuracy

Number quoted is the number of PII words missed as a fraction of total number of words. Computed on a 268 thousand word internal test dataset, comprising data from over 50 different sources, including web scrapes, emails and ASR transcripts.

Please contact us for a copy of the code used to compute these metrics, try it yourself here, or download our whitepaper.