Remove direct identifiers before a health record is summarized
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List each direct identifier the lawyer marks, the page it appears on, and a proposed removal. Do not send the record to a tool and do not say the result is de-identified.
- What the lawyer must review
- 45 CFR § 164.502 provides that a covered entity or a business associate may not use or disclose protected health information except as permitted or required by that subpart or by subpart C of part 160. A permitted disclosure includes disclosure to the individual and, as § 164.506 allows, for treatment, payment, or health care operations. The de-identification standard was not opened. Do not treat a removal of names as meeting it. You decide whether a disclosure is permitted before any record is put into a tool. Formal Opinion 512 requires informed consent before information relating to the representation goes into a self-learning tool. The HHS covered-entity page is the starting point for whether the holder is a covered entity or a business associate.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes identifying points for review. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.