---
title: "Assess whether a dataset is de-identified before it is shared"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-whether-a-dataset-is-de-identified-before-it-is-shared-or-release/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-Y20261018-9-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Assess whether a dataset is de-identified before it is shared

> List the identifiers still present and which de-identification method the instructions claim. Do not mark the dataset as de-identified.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-whether-a-dataset-is-de-identified-before-it-is-shared-or-release/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List the identifiers still present and which de-identification method the instructions claim. Do not mark the dataset as de-identified. |
| What the lawyer must review | For protected health information, 45 CFR section 164.514(b) allows a covered entity to treat health information as not individually identifiable only by expert determination or by removing the listed identifiers under the safe-harbor method, including specified geographic detail. HHS guidance states that information de-identified under section 164.514(a) and (b) is no longer protected health information. That test is not the CCPA test. Civil Code section 1798.140(m) defines "deidentified" as information that cannot reasonably be used to infer information about, or be linked to, a particular consumer, and only if the business takes reasonable measures to prevent association with a consumer or household, publicly commits to keep and use it in deidentified form and not to reidentify it except to test the process, and contractually binds recipients to the same duties. HIPAA safe harbor does not by itself satisfy that definition. The lawyer decides. Opinion 512: do not upload the dataset to a public tool to "check" it. |
| Written for | United States |
| Applies to | [Assess whether a dataset is de-identified before it is shared or released](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-whether-a-dataset-is-de-identified-before-it-is-shared-or-release.md) |

## Checking plan

- What the AI does: List the identifiers still present and which de-identification method the instructions claim. Do not mark the dataset as de-identified.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Say which statute you are applying. A dataset can fail one test and pass the other.
- Do not describe removal of names alone as de-identification.

## Sources

- [45 CFR section 164.514 (other requirements relating to uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (checked 2026-10-22)
- [HHS: Guidance on de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html) (checked 2026-10-22)
- [California Civil Code section 1798.140 (definition of deidentified)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/de-identification-assessment-before-sharing-or-release.md) | Checklist | Yellow | Record for deciding whether a dataset is de-identified (no longer about an identified or reasonably identifiable individual) before it is shared, sold, published or used to train a model: the data,… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*