The De-Identified Dataset

Privacy notice: 'To operate and improve the service and for analytics' is a purpose limitation that a reasonable patient would read as internal service improvement, not as licensing a dataset to a drug manufacturer. Notice-and-consent ethics requires that consent be informed and specific to the use; a generic analytics clause does not disclose commercial licensing, the recipient, or the price. Under a contextual-integrity approach, the transmission of app-logged health data to a pharmaceutical buyer violates the norms of the context in which patients disclosed it - a clinical-support relationship - even if the literal words could be stretched to cover it.

Clinic contracts: the 'no sale or disclosure without written authorization' clause is a direct obstacle. Two arguments fail: (a) 'it's de-identified, so it isn't patient data' - the contract likely defines patient data broadly, and the company should not resolve ambiguity in its own favor when the counterparty is a clinic protecting patients; (b) 'the clinics consented at onboarding' - the contract requires written authorization for the specific disclosure.

HIPAA overlay: if MedAxis is a business associate of covered-entity clinics, disclosure for the buyer's own research or commercial purposes requires authorization or valid de-identification under 45 CFR 164.514. Relabeling identifiers does not by itself satisfy either path.

Replacing names and medical record numbers removes direct identifiers but leaves a combination of quasi-identifiers that is unusually powerful in health data: five-digit ZIP, birth year, dates of service, and longitudinal medication sequences.

Specific risks:

• Date and geography. Exact service dates plus ZIP code are among the strongest re-identification keys available. Birth date plus ZIP alone is famously close to unique for a large share of the population; adding a visit date makes linkage to public records, voter files, or breach corpora feasible.
• Longitudinal sequence. A medication trajectory (e.g., a specific combination and timing of drugs for a rare condition) can be unique even without any demographic field. Sequence is an identifier.
• Small-cell disclosure. Patients at small clinics, or with rare diagnoses, are trivially re-identifiable by anyone who knows the clinic's census.
• Buyer capability. The counterparty is a pharmaceutical company with claims data, prescribing data, and the incentive to link. Motive plus auxiliary data defeats naive anonymization.

Legal point: HIPAA's safe-harbor standard removes 18 identifier categories including all date elements except year and geographic units smaller than a three-digit ZIP; the proposal fails that test on its face. The alternative is expert determination, which requires a qualified statistical analysis of re-identification risk - not a relabeling exercise.

Conclusion: removing names and MRNs is a cosmetic measure, not de-identification.

Before the vote:

1. Legal and contractual review of every clinic agreement; identify which clinics' contracts permit disclosure and obtain written authorization where required. If 140 clinics must consent individually, the deal's feasibility changes - that is a finding, not an obstacle to route around.
2. Re-identification risk assessment by an independent expert, with a documented threat model (what auxiliary data a pharma buyer holds) and a written determination.
3. Privacy impact assessment covering purpose, minimization (are service dates and full ZIP necessary?), retention, and onward-transfer restrictions. Data minimization should be applied before any transfer: shift to month/year, three-digit ZIP, and truncated sequences, and test whether the dataset still has commercial value.
4. Patient-facing transparency. Amend the privacy notice and, if feasible, offer an opt-out for secondary commercial use. Do not rely on a notice that predates the new purpose.
5. Data-use review board with clinical, legal, and patient representation, empowered to block uses, not merely advise.

If the deal proceeds: contract for use limitations, no re-identification and no linkage to other datasets, destruction schedules, audit rights, and a prohibition on onward sale. Escrow a portion of the fee against breach. If clinics will not authorize and patients were not told, the board should decline - $4.1 million is 38% of revenue, but the alternative is a disclosure that is contractually unauthorized and ethically indefensible, and the remediation cost after a complaint would exceed the fee.