Safe Harbor Under Question: The Public Claims Bucket at CareVantage
CareVantage Analytics is a business associate to 30 health plans and provider groups. It ingests claims extracts and publishes de-identified datasets to clients using the HIPAA Safe Harbor method. An engineer testing a new pipeline created an S3 bucket with a public-read ACL. The bucket held a research copy of a claims dataset covering 4,800 members, including 5-digit ZIP code, full dates of service, admission and discharge dates, and claim dollar amounts. Names, member IDs, and Social Security numbers had been removed. Bucket access logs show reads from three external IP addresses over 11 days before the bucket was taken down.
Objects were encrypted at rest with SSE-S3 using the account's default key. CareVantage's security team has argued that because the data was encrypted and because identifiers were removed, no notification is required.
Separately, a client has asked CareVantage to restore member identifiers to the same dataset so it can link members to its own outreach program.
1. Determine whether the Safe Harbor de-identification holds, and explain why that determination drives everything downstream.
Read the worked answer
It does not hold. Safe Harbor requires the removal of 18 specified categories, and two are present here. All elements of dates directly related to an individual, other than year, must be removed, so full dates of service and admission and discharge dates disqualify the dataset. ZIP codes must be reduced to the initial three digits, and even then only where the three-digit combination has a population above 20,000; a five-digit ZIP is an identifier under the rule.
Claim dollar amounts are not themselves on the list, but that is not a defense: the standard is removal of the enumerated identifiers, and the presence of precise geography plus precise dates makes the data individually identifiable in practice, which is exactly what the rule is written to prevent.
The consequence: the dataset is protected health information, CareVantage is a business associate handling PHI, and an unauthorized public exposure of PHI is a potential breach requiring a risk assessment. Note also that dates and ZIP codes are permitted in a limited data set under a data use agreement, so the correct design here was an LDS, not Safe Harbor, and that distinction should be fixed in the pipeline before it is redeployed.
Document the determination and its basis; regulators and covered entities will ask what analysis was performed and when.
2. Who must notify whom, and how should the encryption argument and the access logs be weighed in the breach risk assessment?
Read the worked answer
CareVantage, as a business associate, notifies each affected covered entity without unreasonable delay and no later than 60 days after discovery; the covered entities then notify individuals (generally within 60 days), the Department of Health and Human Services, and the media where 500 or more residents of a state are affected. Check every business associate agreement too, because many impose shorter notice periods than the regulatory outer limit, and some state laws run on 30-day clocks. With 30 covered entities, CareVantage must allocate the 4,800 members to each entity and report per-entity counts, since the 500-person threshold is applied per covered entity and per state.
Encryption: SSE-S3 with a public-read ACL provides no safe harbor. The exception applies only where the PHI was encrypted and the key was not acquired; here anonymous requests are served plaintext because the storage service decrypts transparently for any authorized GET, and the bucket policy authorized everyone. The security team's argument fails on both halves, since the data was not de-identified either.
The access logs are the real evidence. Determine whether the three IPs listed objects, retrieved full objects, or received errors; how many members' records were in the retrieved objects; whether the downloads were automated; and whether any of the addresses resolve to known research or security-scanning sources. Then apply the four-factor assessment: nature and extent of the PHI (geography, dates, claim amounts are highly identifying), the unauthorized recipient, whether the data was actually acquired or viewed, and the extent of mitigation. Absent evidence that the retrieval failed or was trivial, the presumption of breach is likely to stand, and the analysis should be documented contemporaneously.
3. How should CareVantage respond to the client's request to restore member identifiers?
Read the worked answer
Decline the request as framed. A business associate may re-identify only as permitted by its business associate agreement and by the covered entity's authority; a client's commercial desire for outreach is not a legal basis. CareVantage also holds data contributed by 30 covered entities, so re-identification would require authorization from each one whose members are in the extract, not just the requesting client.
Offer compliant alternatives. First, the covered entity performs the linkage itself and returns only aggregate or summary results; CareVantage never holds the key next to the identifiers. Second, if the client is itself a covered entity or business associate with a legitimate purpose, establish it under a written arrangement with a stated purpose, minimum necessary data elements, retention limits, prohibitions on further disclosure, and security requirements, and confirm the covered entities have authorized it.
Test the purpose. Outreach to members may be treatment, payment, or operations, or it may be marketing requiring individual authorization, particularly if the client or a third party is compensated. Research use would normally require an institutional review board or privacy board approval. Also check state law and the consent under which the data was originally collected; HIPAA is a floor.
Separately, the incident should not accelerate this. If anything, re-identification capability increases the sensitivity of the dataset, so tighten key management and require two-person approval for any linkage job.