October 16, 2026
This story is fictional. If it sounds like your hospital, that’s between you and your privacy officer.
The file came in on a Thursday, with a cover email from someone in the hospital’s strategy office who signed herself Best, K. The subject line was De-identified encounter data, Q1–Q3 (as discussed). I don’t know what was discussed. I build audiences; other people discuss.
It was a good file, cleaner than most. One row for each inpatient stay, about forty thousand rows, and no names, as promised. There were no addresses or phone numbers either. What it did have was age, sex, five-digit ZIP code, admission date, discharge date, up to six diagnosis codes, the payer and the attending physician. My job was to turn that into segments a client could buy ads against: recent orthopedic, new diabetic, cardiac, 65 and over, commercially insured. By Friday afternoon I had nine.
Marcus, who sits across from me, looked over my shoulder and said there was a paper somewhere showing you could identify most Americans with nothing but a ZIP code, a birth date and sex. I said the file didn’t have birth dates. He said it had admission dates and ages, which was close enough for anybody who wanted to try. Nobody wanted to try. We had a client deliverable due.
I don’t know why I filtered it to my mother’s ZIP code. Curiosity, I suppose, or the habit of checking a sample against something I knew. It came down to two hundred and some rows, and about halfway down there was a woman, seventy-one, admitted January 9 and discharged January 14. That was the week of Mom’s fall. My sister and I had taken turns driving up.
The first diagnosis code was S72.001A, which I recognized because the orthopedic segment was built on codes like it: a broken hip, first visit. That was right. She had slipped on the ice by the mailbox, she told us, and lain there twenty minutes before the neighbor saw her.
The second code was F10.239. I didn’t recognize that one.
I looked it up. Then I closed the file, told Marcus I wasn’t feeling well, and drove home the long way. That night I called my mother and asked how the hip was coming along, and she told me again about the ice.
Before you read on: Was this file de-identified? If not, what could the hospital have sent instead? Could a marketing firm have received it at all?
Taking the names off a file does not de-identify it. Under the safe harbor method, 45 C.F.R. § 164.514(b)(2), the hospital had to remove eighteen kinds of identifiers. Among them are all elements of dates except the year that relate directly to the patient, which includes admission and discharge dates. The list also covers every geographic unit smaller than a state, with one exception: the first three digits of a ZIP code may stay if the area they cover has more than 20,000 people. Ages over 89 have to be grouped together. The hospital also must have no actual knowledge that what remains could identify someone. This file kept exact dates and five-digit ZIP codes, so it was PHI, and sending it to the firm was a disclosure of PHI for every row.
The other route to de-identification is expert determination under § 164.514(b)(1). A qualified expert applies statistical methods and documents that the risk of identifying anyone is very small, sometimes allowing coarsened dates or partial geography that safe harbor would strip. Nothing in K.’s email suggests that anyone did this.
A limited data set under § 164.514(e) may keep dates and five-digit ZIP codes, but only for research, public health or health care operations, and only under a data use agreement. Building ad audiences fits none of those purposes. If the firm paid for the file, it was also a sale of PHI, which requires the patients’ authorization (§ 164.502(a)(5)(ii)). Targeting ads at patients using their diagnoses is marketing under § 164.508(a)(3) and requires authorization too.
Because the recipient used the data for exactly the purpose it was sent for, the hospital cannot show a low probability of compromise under § 164.402.
To prevent a repeat, no dataset should leave labeled “de-identified” until the privacy office has checked it against all eighteen identifiers, or until an expert determination memo is on file. Let the recipient’s purpose pick the tool: de-identified data for anyone, a limited data set under a data use agreement for the three permitted purposes, and an authorization for everything else.
Takeaway: A file isn’t de-identified until someone has checked it against all eighteen identifiers.