Assess whether a dataset is de-identified before it is shared
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- List the identifiers still present and which de-identification method the instructions claim. Do not mark the dataset as de-identified.
- What the lawyer must review
- For protected health information, 45 CFR section 164.514(b) allows a covered entity to treat health information as not individually identifiable only by expert determination or by removing the listed identifiers under the safe-harbor method, including specified geographic detail. HHS guidance states that information de-identified under section 164.514(a) and (b) is no longer protected health information. That test is not the CCPA test. Civil Code section 1798.140(m) defines "deidentified" as information that cannot reasonably be used to infer information about, or be linked to, a particular consumer, and only if the business takes reasonable measures to prevent association with a consumer or household, publicly commits to keep and use it in deidentified form and not to reidentify it except to test the process, and contractually binds recipients to the same duties. HIPAA safe harbor does not by itself satisfy that definition. The lawyer decides. Opinion 512: do not upload the dataset to a public tool to "check" it.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes identifying points for review. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Check the specialist’s assumptions, qualifications and limits. Obtain the relevant expert or specialist review before relying on a technical conclusion.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.