Full ZIP Codes and Exact Dates in a De-Identified Health Dataset
MediTrust Analytics licenses de-identified electronic health records to academic researchers. Its current release contains 1.4 million patients from 12 hospitals. Direct identifiers are removed, dates are shifted by a random per-patient offset, ages above 89 are aggregated, and ZIP codes are truncated to three digits. A researcher studying environmental exposures requests full nine-digit ZIP codes and exact admission and discharge dates for 300,000 patients in three states. The sales vice president supports the request because two competitors provide similar data and the contract is worth $2.1 million. The privacy office notes that MediTrust has never completed a HIPAA expert determination; it relied on Safe Harbor. An internal risk assessment cites a published study showing 99.6% re-identification of a similar dataset using five-digit ZIP, birth date, and gender. The researcher has IRB approval and a data use agreement. The engineering team says re-linking is technically feasible with public voter files. The board asks for a decision within two weeks.
1. Does the requested release satisfy HIPAA Safe Harbor or require an expert determination? Analyze the legal and ethical issues, including re-identification risk and the significance of the IRB approval and data use agreement.
Read the worked answer
Legal analysis. Full nine-digit ZIP codes and exact admission and discharge dates are identifiers under the HIPAA Safe Harbor method. Safe Harbor permits only the first three digits of a ZIP code where the geographic unit has more than 20,000 people, and it does not permit full dates other than year. The requested release therefore cannot be made under Safe Harbor. The alternative is the expert determination standard: a person with appropriate statistical knowledge must determine that the risk of re-identification is very small. The internal study showing 99.6% re-identification using ZIP, birth date, and gender is precisely the evidence that must be evaluated. IRB approval and a data use agreement are important safeguards, but they do not substitute for the legal determination and do not eliminate re-identification risk.
Ethical analysis. Confidentiality is a duty owed to patients, not merely a compliance checkbox. Re-identification can cause stigma, insurance discrimination, and dignitary harm. The researcher's legitimate interest must be weighed against the probability and magnitude of harm, the necessity of the requested granularity, and whether less intrusive alternatives exist. Sales pressure and competitor practice are not ethical justifications. A principles-based approach requires respect for persons through transparency and attention to consent, and justice requires that burdens not fall disproportionately on vulnerable groups.
Conclusion. The request should not be granted as specified without a valid expert determination and additional safeguards. The data use agreement is necessary but insufficient.
2. Recommend a course of action that preserves research value while meeting legal and ethical obligations. Include specific technical and contractual safeguards and the decision criteria you would use.
Read the worked answer
A defensible response is not a simple refusal. The organization should first pause the request and complete a documented risk assessment with privacy, legal, security, and the researcher. It should then choose among graduated options:
- Alternative data: provide three-digit ZIP, relative dates, season or year, or aggregated exposure measures rather than full identifiers.
- Privacy-enhancing methods: use a secure enclave where the researcher runs approved queries without receiving record-level data; consider synthetic data, differential privacy, or coarsened dates and geography.
- Expert determination: if full ZIP and exact dates are essential, commission an independent expert determination and document the methods, residual risk, and monitoring.
- Contractual controls: prohibit re-identification, require security safeguards, audit rights, breach notification, destruction, and restrictions on onward transfer.
- Review: consult the IRB and, where appropriate, patient or community representatives.
Decision criteria should include necessity and proportionality, severity of potential harm, feasibility of less intrusive alternatives, transparency to patients, and the organization's ability to monitor and enforce the agreement. The decision should be recorded with the alternatives considered. If the expert determination cannot show very small risk, the request should be denied or narrowed.
3. The sales vice president argues that refusing will lose the contract and that competitors already do this. How should the organization respond, and what should be documented?
Read the worked answer
Competitive pressure is a business consideration, not a legal or ethical justification. The organization should acknowledge the revenue at stake, then separate the commercial question from the compliance and ethics question. It should explain that competitors' practices do not establish legality or acceptability, and that a breach could trigger regulatory action, contractual liability, reputational harm, and loss of patient trust.
Documentation should include the request, the legal analysis under Safe Harbor and expert determination, the risk assessment and re-identification study, the alternatives offered, the researcher's justification, the decision and rationale, any dissent, and the approvals. If the sales vice president continues to press for an unjustified release, the issue should be escalated to compliance and the board or audit committee. The organization should also prepare a customer-facing explanation and a standard playbook for similar requests. A record showing that the company considered revenue but chose proportionate safeguards demonstrates accountability and makes later second-guessing easier to answer.