Expert Determination and the High Standard for Protecting Patient Data

The protection of patient information in the United States is governed, in large part, by the federal HIPAA Privacy and Security Rules. These rules establish when health information may be used and disclosed and when it must be safeguarded. For healthcare technology companies, compliance traditionally begins with legal and contractual mechanisms such as Business Associate Agreements and Data Use Agreements, which define the circumstances under which information may be accessed, exchanged, and protected.

Those agreements remain essential, but they do not alter the underlying nature of the information itself. Data subject to a Business Associate Agreement remains Protected Health Information, and the obligations associated with that designation remain intact.

De-identification represents a different and, in many respects, more durable layer of protection. Rather than regulating how information may be used, de-identification changes the status of the information itself by removing the reasonable ability to connect the data to a particular person. This distinction has become increasingly important as health systems and their technology partners deploy advanced analytics, automation platforms, and artificial intelligence tools that derive value from large volumes of clinical information.

Healthcare intelligence platforms are frequently entrusted with information for purposes that extend beyond a single transactional exchange, including operational improvement, quality assurance, performance analytics, product development, and other activities intended to improve the services ultimately provided to healthcare organizations.

De-identification is not legally required in every circumstance. HIPAA and HITECH expressly permit many uses and disclosures of Protected Health Information pursuant to appropriate contractual safeguards and regulatory requirements.

Nevertheless, as healthcare organizations and their technology partners increasingly retain, analyze, and learn from information to evolve their products and better serve health systems, the question becomes not merely what is permissible under the law, but what additional measures can be taken to reduce privacy risk. In that environment, the highest practicable degree of privacy and security should remain at the forefront of every healthcare technology company’s decision-making process.

In plain terms, health information is considered de-identified when it can no longer reasonably be connected to a particular patient. Once that condition is satisfied, the information is no longer treated as Protected Health Information, and most of the Privacy Rule’s restrictions cease to apply because there is no longer an identifiable person behind the data.

Properly performed, de-identification permits clinical information to be retained, analyzed, and used responsibly while preserving the privacy of the individuals behind it. It also gives healthcare entities and their technology partners important protection should information be intercepted by an unauthorized party: the information itself no longer identifies a patient or creates the same privacy-related liability risk. Health systems can use modern analytics, automation, and intelligent software with greater confidence that the information has been evaluated under a recognized framework designed to prevent re-identification.

The HIPAA Privacy Rule recognizes two methods by which de-identification may be accomplished, and the distinction between them is significant.

The first, commonly referred to as the Safe Harbor method, operates as a prescribed checklist. It requires the removal of eighteen specified identifiers, including names, full dates, and detailed geographic information. Once those identifiers are removed—and the covered entity has no actual knowledge that the remaining information could identify an individual—the information is deemed de-identified. The method is straightforward, predictable, and appropriate for many routine purposes, especially structured data held in discrete fields.

The second method, and the one Just Healthcare Solutions elected to pursue, is known as Expert Determination. Under this approach, a qualified individual with appropriate statistical and scientific expertise evaluates both the health data and the circumstances in which it will be used. The expert applies generally accepted methodologies to determine whether the remaining information could re-identify a person, often after removing, obfuscating, or substituting both direct and indirect identifiers, and formally certifies that the risk of re-identifying any individual is very small.

The expert must document the basis for that low-risk conclusion and preserve the supporting analysis for review. Put simply, Expert Determination does not depend on a fixed list of removed fields alone. It depends on independent expert verification that the information, in the context in which it will actually be used, cannot reasonably be traced back to a patient.

Our decision to pursue the more rigorous method rests on the nature of the information we process and the obligations we owe to the healthcare organizations we serve.

The materials central to the JustAppeals suite include unstructured clinical narratives: physician documentation, treatment rationales, pathology discussions, and medical analyses that explain why a particular course of care is appropriate. Information of this kind does not reside neatly within discrete database fields where a checklist can address every risk.

A clinical narrative may contain combinations of diagnoses, procedures, treatment timelines, rare clinical circumstances, geographic references, or other contextual details that are not identifiers in isolation but can collectively narrow the field of possible individuals. A defensible privacy program must account for those combinations, not only obvious identifiers.

Preventing re-identification becomes even more important in an era of advanced analytics and artificial intelligence. Modern software systems are designed to identify patterns, relationships, and contextual meaning within large volumes of information. The relevant question is no longer merely whether obvious identifiers such as names or addresses have been removed. It is whether the remaining information, viewed in its entirety and alongside other reasonably available information, could permit a patient to be re-identified. Expert Determination is uniquely suited to evaluate that risk because it examines information as it exists and as it will be used.

For that reason, we subjected our de-identification methodology to independent review. The Expert Determination process required a formal assessment of whether information processed by our platform could reasonably be used—alone or in combination with other available information—to identify an individual patient.

The resulting determination found that our approach met the required very-low-risk standard. This is not an internal statement about compliance. It is a documented analysis performed by an independent expert applying an established legal, statistical, and scientific standard.

The significance extends beyond regulatory compliance. Healthcare organizations increasingly expect technology partners to demonstrate not only that patient information is secured from unauthorized access, but also that information processed within intelligent systems cannot readily be traced back to the individuals from whom it originated. These are related but distinct concerns.

Encryption, access controls, cybersecurity programs, and technical safeguards address the risk of unauthorized acquisition. De-identification addresses the separate risk of re-identification and privacy. Both forms of protection are necessary for the responsible use of healthcare data.

Obtaining this assurance required a substantial investment of time, resources, and independent expertise. The process involved detailed evaluation of data flows, document structures, de-identification methodologies, and re-identification risk across the forms of clinical documentation routinely encountered by the platform.

That investment matters because independent validation provides evidence, transparency, and defensibility that an internal review alone cannot easily replicate.

The completion of Expert Determination is not best understood as a procedural compliance milestone. It is part of the foundational and iterative infrastructure required for the responsible deployment of artificial intelligence in healthcare.

As health systems adopt intelligent software to support clinical, operational, and administrative functions, the ability to demonstrate that patient information cannot reasonably be traced back to an individual is becoming a foundational requirement for trust and responsible innovation. Our investment in Expert Determination provides independent, documented evidence that clinical information can be used for legitimate healthcare purposes while preserving the privacy protections that patients and providers rightly expect.