Reusing Hospital Records for a Vendor Sepsis Model
A regional hospital's analytics unit holds 1.2 million de-identified encounter records from 2018–2023. The original patient notice said data would be used 'to support treatment, payment, and hospital operations.' A vendor offers a free sepsis-prediction model but requires the full encounter table-admission and discharge dates, 5-digit ZIP, and free-text triage notes-to retrain it. The privacy officer proposes hashing patient IDs and removing names and street addresses; the vendor calls the result 'de-identified.' A clinical champion says the model could reduce sepsis deaths, and the vendor's offer expires in 60 days. State law requires written authorization for marketing use but not for quality improvement. The vendor will host the data in its own cloud account and retain it for model improvement. The analytics lead asks whether to sign and what conditions would make reuse acceptable.
1. Identify the governance and ethics issues in the proposed reuse. Is hashing IDs plus removing names and addresses sufficient de-identification? Explain.
Read the worked answer
The proposal fails purpose limitation and disclosure review. The original notice covers treatment, payment, and operations; vendor model training is a new purpose, and 'quality improvement' does not automatically authorize a third-party commercial use. Hashing IDs is pseudonymization, not de-identification: the hospital or vendor may still re-identify, and the combination of admission/discharge dates, 5-digit ZIP, and free-text triage notes is highly identifying. Free text often contains names, ages, and family details. Under a HIPAA-style safe-harbor analysis, dates and ZIPs are identifiers; an expert determination would be needed. The vendor's retention for model improvement also exceeds minimum necessary and creates secondary-use risk. The ethics issues are patient trust, transparency, and equity if the model is trained on unrepresentative records. Therefore the data as proposed are not de-identified, and signing would create an unauthorized disclosure.
2. Recommend a decision and the contractual and technical controls that would make the project acceptable, or justify declining.
Read the worked answer
Decision: do not sign the current offer. A defensible path is: (1) obtain a legal basis-authorization, waiver, or a documented QI determination-and complete a privacy impact assessment; (2) sign a data-use agreement/BAA with purpose limitation, no secondary use, deletion, audit, and breach terms; (3) minimize data: aggregate features, remove free text, shift dates, reduce ZIP to 3 digits or region, and exclude direct identifiers; (4) require expert determination and prohibit re-identification; (5) keep data in the hospital environment or use federated learning so the vendor never receives records; (6) provide patient notice/opt-out where required; (7) validate the model locally and monitor performance and bias. If the vendor will not accept these controls, decline or use synthetic data for a pilot. The 60-day deadline is not a justification for weaker governance.